Edit tour

Windows Analysis Report
INV.2022LB0362 FORM CO (2).exe

Overview

General Information

Sample Name:	INV.2022LB0362 FORM CO (2).exe
Analysis ID:	756310
MD5:	baed30aea51e6000571219633aa745b0
SHA1:	d7e3b155c00245a7f867dd2fb4c06cb7be6ec3f7
SHA256:	57520e51bb0820741b7883926800223886c491a8a5ddd517a49b0e2cc752fb18
Tags:	exeLoki
Infos:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Yara detected Lokibot

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Yara detected aPLib compressed binary

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Detected potential crypto function

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

INV.2022LB0362 FORM CO (2).exe (PID: 6092 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

INV.2022LB0362 FORM CO (2).exe (PID: 2240 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

INV.2022LB0362 FORM CO (2).exe (PID: 5164 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

INV.2022LB0362 FORM CO (2).exe (PID: 6132 cmdline: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe MD5: BAED30AEA51E6000571219633AA745B0)

cleanup

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://sempersim.su/gm11/fre.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x180c8:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x5493:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13cd7:$des3: 68 03 66 00 00 0x180c8:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x18194:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x37f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x32e90:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x2024f:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x2ea93:$des3: 68 03 66 00 00 0x32e90:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x32f5c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000003.00000002.506514782.0000000001238000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000003.00000000.255040267.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x43bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x510a8:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3e473:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x4ccb7:$des3: 68 03 66 00 00 0x510a8:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x51174:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x2dd9c:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x570a6:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x155d18:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x299d:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x16c74:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13280:$s2: https:// 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x16c74:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13280:$s2: https:// 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x2ef38:$s1: http:// 0x326f3:$s1: http:// 0x3314c:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x2ef40:$s2: https:// 0x2ef38:$f1: http:// 0x326f3:$f1: http:// 0x2ef40:$f2: https://
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x315f6:$f1: FileZilla\recentservers.xml 0x31636:$f2: FileZilla\sitemanager.xml 0x2f8a6:$b2: Mozilla\Firefox\Profiles 0x2f610:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2f7ba:$s4: logins.json 0x30664:$s6: wand.dat 0x2f0e4:$a1: username_value 0x2f0d4:$a2: password_value 0x2f71f:$a3: encryptedUsername 0x2f78c:$a3: encryptedUsername 0x2f732:$a4: encryptedPassword 0x2f7a0:$a4: encryptedPassword
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x324b0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x1f86f:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x2ee74:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x2f0bc:$a2: last_compatible_version
0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x2e0b3:$des3: 68 03 66 00 00 0x324b0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x3257c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 43 entries

Snort Signatures

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802024318 11/30/22-00:54:20.168790
SID:	2024318
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802021641 11/30/22-00:54:14.871390
SID:	2021641
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802024313 11/30/22-00:55:23.450513
SID:	2024313
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802825766 11/30/22-00:55:16.065951
SID:	2825766
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497272025483 11/30/22-00:55:04.982566
SID:	2025483
Source Port:	80
Destination Port:	49727
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802024313 11/30/22-00:55:29.247109
SID:	2024313
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802825766 11/30/22-00:54:12.581436
SID:	2825766
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802025381 11/30/22-00:55:43.976237
SID:	2025381
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802825766 11/30/22-00:56:01.042444
SID:	2825766
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802024318 11/30/22-00:55:23.450513
SID:	2024318
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802021641 11/30/22-00:55:17.863854
SID:	2021641
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802024313 11/30/22-00:54:20.168790
SID:	2024313
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802024318 11/30/22-00:55:29.247109
SID:	2024318
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497232025483 11/30/22-00:54:57.894669
SID:	2025483
Source Port:	80
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802025381 11/30/22-00:55:49.378987
SID:	2025381
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802025381 11/30/22-00:54:43.829219
SID:	2025381
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802021641 11/30/22-00:54:24.716724
SID:	2021641
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802025381 11/30/22-00:55:58.948901
SID:	2025381
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802021641 11/30/22-00:55:08.823725
SID:	2021641
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.861416532014169 11/30/22-00:55:12.379224
SID:	2014169
Source Port:	61416
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860088532014169 11/30/22-00:55:21.529314
SID:	2014169
Source Port:	60088
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802024313 11/30/22-00:54:37.979213
SID:	2024313
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802825766 11/30/22-00:55:01.673863
SID:	2825766
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802024318 11/30/22-00:54:37.979213
SID:	2024318
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857743532014169 11/30/22-00:55:08.735474
SID:	2014169
Source Port:	57743
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802825766 11/30/22-00:55:53.496270
SID:	2825766
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497572025483 11/30/22-00:55:59.773200
SID:	2025483
Source Port:	80
Destination Port:	49757
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802025381 11/30/22-00:55:34.401351
SID:	2025381
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859820532014169 11/30/22-00:55:29.162121
SID:	2014169
Source Port:	59820
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853305532014169 11/30/22-00:54:54.648302
SID:	2014169
Source Port:	53305
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497532025483 11/30/22-00:55:52.887247
SID:	2025483
Source Port:	80
Destination Port:	49753
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802025381 11/30/22-00:54:26.803652
SID:	2025381
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497162025483 11/30/22-00:54:45.204539
SID:	2025483
Source Port:	80
Destination Port:	49716
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497382025483 11/30/22-00:55:24.982216
SID:	2025483
Source Port:	80
Destination Port:	49738
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249758802024313 11/30/22-00:56:00.034214
SID:	2024313
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249755802021641 11/30/22-00:55:55.653974
SID:	2021641
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497302025483 11/30/22-00:55:10.337695
SID:	2025483
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497342025483 11/30/22-00:55:17.565495
SID:	2025483
Source Port:	80
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249758802024318 11/30/22-00:56:00.034214
SID:	2024318
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852387532014169 11/30/22-00:54:14.412323
SID:	2014169
Source Port:	52387
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249721802024318 11/30/22-00:54:53.572062
SID:	2024318
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249727802021641 11/30/22-00:55:03.486766
SID:	2021641
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249750802021641 11/30/22-00:55:45.758418
SID:	2021641
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497122025483 11/30/22-00:54:37.552263
SID:	2025483
Source Port:	80
Destination Port:	49712
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249718802825766 11/30/22-00:54:47.592007
SID:	2825766
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851992532014169 11/30/22-00:55:36.286012
SID:	2014169
Source Port:	51992
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860625532014169 11/30/22-00:54:18.863516
SID:	2014169
Source Port:	60625
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249736802025381 11/30/22-00:55:19.643476
SID:	2025381
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249721802024313 11/30/22-00:54:53.572062
SID:	2024313
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249746802825766 11/30/22-00:55:38.275174
SID:	2825766
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249722802021641 11/30/22-00:54:54.732179
SID:	2021641
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249699802025381 11/30/22-00:54:07.324934
SID:	2025381
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249714802021641 11/30/22-00:54:39.977728
SID:	2021641
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497492025483 11/30/22-00:55:45.483574
SID:	2025483
Source Port:	80
Destination Port:	49749
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249712802025381 11/30/22-00:54:35.972913
SID:	2025381
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857840532014169 11/30/22-00:54:09.401173
SID:	2014169
Source Port:	57840
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858301532014169 11/30/22-00:55:42.001541
SID:	2014169
Source Port:	58301
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249740802025381 11/30/22-00:55:27.193434
SID:	2025381
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497422025483 11/30/22-00:55:32.668199
SID:	2025483
Source Port:	80
Destination Port:	49742
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863562532014169 11/30/22-00:55:23.368358
SID:	2014169
Source Port:	63562
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497412025483 11/30/22-00:55:30.821604
SID:	2025483
Source Port:	80
Destination Port:	49741
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.850784532014169 11/30/22-00:55:55.557056
SID:	2014169
Source Port:	50784
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249723802021641 11/30/22-00:54:56.463103
SID:	2021641
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802825766 11/30/22-00:54:37.979213
SID:	2825766
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802024313 11/30/22-00:55:01.673863
SID:	2024313
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249728802025381 11/30/22-00:55:05.285201
SID:	2025381
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802024318 11/30/22-00:55:01.673863
SID:	2024318
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249737802025381 11/30/22-00:55:21.614296
SID:	2025381
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497112025483 11/30/22-00:54:35.462242
SID:	2025483
Source Port:	80
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856949532014169 11/30/22-00:54:59.841953
SID:	2014169
Source Port:	56949
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249753802024318 11/30/22-00:55:51.242717
SID:	2024318
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249753802024313 11/30/22-00:55:51.242717
SID:	2024313
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497082025483 11/30/22-00:54:28.382639
SID:	2025483
Source Port:	80
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249714802825766 11/30/22-00:54:39.977728
SID:	2825766
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249725802024313 11/30/22-00:54:59.930841
SID:	2024313
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249756802025381 11/30/22-00:55:57.533680
SID:	2025381
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860825532014169 11/30/22-00:55:59.940841
SID:	2014169
Source Port:	60825
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802024313 11/30/22-00:55:53.496270
SID:	2024313
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249748802021641 11/30/22-00:55:42.098367
SID:	2021641
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249725802024318 11/30/22-00:54:59.930841
SID:	2024318
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249742802021641 11/30/22-00:55:31.101064
SID:	2021641
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249755802825766 11/30/22-00:55:55.653974
SID:	2825766
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802024318 11/30/22-00:55:53.496270
SID:	2024318
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249709802025381 11/30/22-00:54:29.164231
SID:	2025381
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849977532014169 11/30/22-00:54:06.875981
SID:	2014169
Source Port:	49977
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856924532014169 11/30/22-00:54:16.879287
SID:	2014169
Source Port:	56924
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249700802024317 11/30/22-00:54:09.487691
SID:	2024317
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249739802825766 11/30/22-00:55:25.267085
SID:	2825766
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860582532014169 11/30/22-00:54:28.778637
SID:	2014169
Source Port:	60582
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497192025483 11/30/22-00:54:51.280995
SID:	2025483
Source Port:	80
Destination Port:	49719
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864595532014169 11/30/22-00:55:31.020256
SID:	2014169
Source Port:	64595
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249742802825766 11/30/22-00:55:31.101064
SID:	2825766
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249700802024312 11/30/22-00:54:09.487691
SID:	2024312
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249711802025381 11/30/22-00:54:33.859062
SID:	2025381
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860767532014169 11/30/22-00:54:45.460012
SID:	2014169
Source Port:	60767
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249739802021641 11/30/22-00:55:25.267085
SID:	2021641
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249724802025381 11/30/22-00:54:58.184483
SID:	2025381
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249751802021641 11/30/22-00:55:47.279515
SID:	2021641
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249758802825766 11/30/22-00:56:00.034214
SID:	2825766
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249710802021641 11/30/22-00:54:31.910937
SID:	2021641
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249711802021641 11/30/22-00:54:33.859062
SID:	2021641
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849201532014169 11/30/22-00:56:00.958664
SID:	2014169
Source Port:	49201
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249729802024313 11/30/22-00:55:07.068054
SID:	2024313
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249758802025381 11/30/22-00:56:00.034214
SID:	2025381
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497262025483 11/30/22-00:55:03.204141
SID:	2025483
Source Port:	80
Destination Port:	49726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249743802025381 11/30/22-00:55:32.962709
SID:	2025381
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249729802024318 11/30/22-00:55:07.068054
SID:	2024318
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802021641 11/30/22-00:55:34.401351
SID:	2021641
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802021641 11/30/22-00:55:01.673863
SID:	2021641
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249750802024313 11/30/22-00:55:45.758418
SID:	2024313
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249710802825766 11/30/22-00:54:31.910937
SID:	2825766
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497222025483 11/30/22-00:54:56.166551
SID:	2025483
Source Port:	80
Destination Port:	49722
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249750802024318 11/30/22-00:55:45.758418
SID:	2024318
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249699802021641 11/30/22-00:54:07.324934
SID:	2021641
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497202025483 11/30/22-00:54:53.259308
SID:	2025483
Source Port:	80
Destination Port:	49720
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802021641 11/30/22-00:54:12.581436
SID:	2021641
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853623532014169 11/30/22-00:55:10.547934
SID:	2014169
Source Port:	53623
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802021641 11/30/22-00:55:53.496270
SID:	2021641
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249715802025381 11/30/22-00:54:42.060768
SID:	2025381
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852955532014169 11/30/22-00:54:26.705694
SID:	2014169
Source Port:	52955
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249740802024313 11/30/22-00:55:27.193434
SID:	2024313
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249740802024318 11/30/22-00:55:27.193434
SID:	2024318
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802025381 11/30/22-00:55:23.450513
SID:	2025381
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249731802021641 11/30/22-00:55:10.632751
SID:	2021641
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802021641 11/30/22-00:55:49.378987
SID:	2021641
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249703802021641 11/30/22-00:54:16.960834
SID:	2021641
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249712802024313 11/30/22-00:54:35.972913
SID:	2024313
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249727802825766 11/30/22-00:55:03.486766
SID:	2825766
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249717802025381 11/30/22-00:54:45.540558
SID:	2025381
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859581532014169 11/30/22-00:55:17.784201
SID:	2014169
Source Port:	59581
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249712802024318 11/30/22-00:54:35.972913
SID:	2024318
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497312025483 11/30/22-00:55:12.166821
SID:	2025483
Source Port:	80
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249739802024313 11/30/22-00:55:25.267085
SID:	2024313
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249725802025381 11/30/22-00:54:59.930841
SID:	2025381
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849166532014169 11/30/22-00:55:40.126118
SID:	2014169
Source Port:	49166
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.860749532014169 11/30/22-00:54:58.103973
SID:	2014169
Source Port:	60749
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497052025483 11/30/22-00:54:21.783216
SID:	2025483
Source Port:	80
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853975532014169 11/30/22-00:54:22.160619
SID:	2014169
Source Port:	53975
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249753802025381 11/30/22-00:55:51.242717
SID:	2025381
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802021641 11/30/22-00:55:58.948901
SID:	2021641
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802021641 11/30/22-00:54:43.829219
SID:	2021641
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249739802024318 11/30/22-00:55:25.267085
SID:	2024318
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802825766 11/30/22-00:55:29.247109
SID:	2825766
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249700802825766 11/30/22-00:54:09.487691
SID:	2825766
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249720802024313 11/30/22-00:54:51.608521
SID:	2024313
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802024318 11/30/22-00:54:26.803652
SID:	2024318
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497482025483 11/30/22-00:55:43.661913
SID:	2025483
Source Port:	80
Destination Port:	49748
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249731802825766 11/30/22-00:55:10.632751
SID:	2825766
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802024313 11/30/22-00:54:14.871390
SID:	2024313
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249720802024318 11/30/22-00:54:51.608521
SID:	2024318
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249737802825766 11/30/22-00:55:21.614296
SID:	2825766
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802024318 11/30/22-00:54:14.871390
SID:	2024318
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249719802825766 11/30/22-00:54:49.641508
SID:	2825766
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.863446532014169 11/30/22-00:55:43.898414
SID:	2014169
Source Port:	63446
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497092025483 11/30/22-00:54:30.691043
SID:	2025483
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497432025483 11/30/22-00:55:34.122250
SID:	2025483
Source Port:	80
Destination Port:	49743
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802024313 11/30/22-00:54:26.803652
SID:	2024313
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858119532014169 11/30/22-00:55:38.197046
SID:	2014169
Source Port:	58119
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857990532014169 11/30/22-00:54:11.706174
SID:	2014169
Source Port:	57990
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802024318 11/30/22-00:56:01.042444
SID:	2024318
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249709802825766 11/30/22-00:54:29.164231
SID:	2825766
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802024313 11/30/22-00:55:08.823725
SID:	2024313
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249745802025381 11/30/22-00:55:36.377571
SID:	2025381
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249724802021641 11/30/22-00:54:58.184483
SID:	2021641
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802024313 11/30/22-00:56:01.042444
SID:	2024313
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249703802825766 11/30/22-00:54:16.960834
SID:	2825766
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249704802025381 11/30/22-00:54:18.966132
SID:	2025381
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497152025483 11/30/22-00:54:43.541337
SID:	2025483
Source Port:	80
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802024318 11/30/22-00:55:08.823725
SID:	2024318
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249718802024318 11/30/22-00:54:47.592007
SID:	2024318
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864121532014169 11/30/22-00:55:57.444180
SID:	2014169
Source Port:	64121
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249719802021641 11/30/22-00:54:49.641508
SID:	2021641
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249721802825766 11/30/22-00:54:53.572062
SID:	2825766
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497042025483 11/30/22-00:54:19.714505
SID:	2025483
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249747802021641 11/30/22-00:55:40.214633
SID:	2021641
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849874532014169 11/30/22-00:55:45.675021
SID:	2014169
Source Port:	49874
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249722802025381 11/30/22-00:54:54.732179
SID:	2025381
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249718802024313 11/30/22-00:54:47.592007
SID:	2024313
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853428532014169 11/30/22-00:55:25.189214
SID:	2014169
Source Port:	53428
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249736802024318 11/30/22-00:55:19.643476
SID:	2024318
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249736802024313 11/30/22-00:55:19.643476
SID:	2024313
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249732802025381 11/30/22-00:55:12.457821
SID:	2025381
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497592025483 11/30/22-00:56:01.793951
SID:	2025483
Source Port:	80
Destination Port:	49759
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249746802024318 11/30/22-00:55:38.275174
SID:	2024318
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802024318 11/30/22-00:55:43.976237
SID:	2024318
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249737802021641 11/30/22-00:55:21.614296
SID:	2021641
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249746802024313 11/30/22-00:55:38.275174
SID:	2024313
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497542025483 11/30/22-00:55:55.161061
SID:	2025483
Source Port:	80
Destination Port:	49754
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802025381 11/30/22-00:55:17.863854
SID:	2025381
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249706802021641 11/30/22-00:54:22.484255
SID:	2021641
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802021641 11/30/22-00:55:16.065951
SID:	2021641
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249699802825766 11/30/22-00:54:07.324934
SID:	2825766
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497322025483 11/30/22-00:55:13.950022
SID:	2025483
Source Port:	80
Destination Port:	49732
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497372025483 11/30/22-00:55:23.147009
SID:	2025483
Source Port:	80
Destination Port:	49737
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802024313 11/30/22-00:55:43.976237
SID:	2024313
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249748802025381 11/30/22-00:55:42.098367
SID:	2025381
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497212025483 11/30/22-00:54:54.418787
SID:	2025483
Source Port:	80
Destination Port:	49721
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497102025483 11/30/22-00:54:33.459515
SID:	2025483
Source Port:	80
Destination Port:	49710
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249733802024313 11/30/22-00:55:14.244291
SID:	2024313
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802025381 11/30/22-00:54:24.716724
SID:	2025381
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249733802024318 11/30/22-00:55:14.244291
SID:	2024318
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.851139532014169 11/30/22-00:54:24.370686
SID:	2014169
Source Port:	51139
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249721802021641 11/30/22-00:54:53.572062
SID:	2021641
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249747802825766 11/30/22-00:55:40.214633
SID:	2825766
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249706802825766 11/30/22-00:54:22.484255
SID:	2825766
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249709802021641 11/30/22-00:54:29.164231
SID:	2021641
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.855638532014169 11/30/22-00:54:39.891168
SID:	2014169
Source Port:	55638
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853466532014169 11/30/22-00:55:06.970990
SID:	2014169
Source Port:	53466
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249717802021641 11/30/22-00:54:45.540558
SID:	2021641
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864823532014169 11/30/22-00:55:34.318234
SID:	2014169
Source Port:	64823
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249706802025381 11/30/22-00:54:22.484255
SID:	2025381
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802825766 11/30/22-00:54:43.829219
SID:	2825766
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249720802021641 11/30/22-00:54:51.608521
SID:	2021641
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865017532014169 11/30/22-00:55:05.186135
SID:	2014169
Source Port:	65017
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802025381 11/30/22-00:55:16.065951
SID:	2025381
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249723802024318 11/30/22-00:54:56.463103
SID:	2024318
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864602532014169 11/30/22-00:55:53.393350
SID:	2014169
Source Port:	64602
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497252025483 11/30/22-00:55:01.390776
SID:	2025483
Source Port:	80
Destination Port:	49725
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497292025483 11/30/22-00:55:08.539654
SID:	2025483
Source Port:	80
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249723802024313 11/30/22-00:54:56.463103
SID:	2024313
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853848532014169 11/30/22-00:54:49.539403
SID:	2014169
Source Port:	53848
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802825766 11/30/22-00:55:34.401351
SID:	2825766
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865107532014169 11/30/22-00:54:47.470066
SID:	2014169
Source Port:	65107
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249739802025381 11/30/22-00:55:25.267085
SID:	2025381
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249712802021641 11/30/22-00:54:35.972913
SID:	2021641
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249753802021641 11/30/22-00:55:51.242717
SID:	2021641
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249725802021641 11/30/22-00:54:59.930841
SID:	2021641
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249748802024318 11/30/22-00:55:42.098367
SID:	2024318
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249731802024313 11/30/22-00:55:10.632751
SID:	2024313
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249748802024313 11/30/22-00:55:42.098367
SID:	2024313
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865196532014169 11/30/22-00:55:14.166464
SID:	2014169
Source Port:	65196
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249731802024318 11/30/22-00:55:10.632751
SID:	2024318
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802825766 11/30/22-00:54:26.803652
SID:	2825766
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802825766 11/30/22-00:55:43.976237
SID:	2825766
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249743802024313 11/30/22-00:55:32.962709
SID:	2024313
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802825766 11/30/22-00:55:58.948901
SID:	2825766
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249743802024318 11/30/22-00:55:32.962709
SID:	2024318
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249728802024318 11/30/22-00:55:05.285201
SID:	2024318
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249750802025381 11/30/22-00:55:45.758418
SID:	2025381
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249700802021641 11/30/22-00:54:09.487691
SID:	2021641
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249728802024313 11/30/22-00:55:05.285201
SID:	2024313
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249714802025381 11/30/22-00:54:39.977728
SID:	2025381
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249724802825766 11/30/22-00:54:58.184483
SID:	2825766
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249719802025381 11/30/22-00:54:49.641508
SID:	2025381
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249756802024318 11/30/22-00:55:57.533680
SID:	2024318
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249742802025381 11/30/22-00:55:31.101064
SID:	2025381
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249733802021641 11/30/22-00:55:14.244291
SID:	2021641
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249729802825766 11/30/22-00:55:07.068054
SID:	2825766
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857704532014169 11/30/22-00:54:41.979608
SID:	2014169
Source Port:	57704
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249715802024318 11/30/22-00:54:42.060768
SID:	2024318
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802825766 11/30/22-00:55:49.378987
SID:	2825766
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249756802024313 11/30/22-00:55:57.533680
SID:	2024313
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249715802024313 11/30/22-00:54:42.060768
SID:	2024313
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249751802024313 11/30/22-00:55:47.279515
SID:	2024313
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249711802825766 11/30/22-00:54:33.859062
SID:	2825766
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249751802024318 11/30/22-00:55:47.279515
SID:	2024318
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249710802024318 11/30/22-00:54:31.910937
SID:	2024318
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249710802024313 11/30/22-00:54:31.910937
SID:	2024313
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249747802025381 11/30/22-00:55:40.214633
SID:	2025381
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802025381 11/30/22-00:54:12.581436
SID:	2025381
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249755802025381 11/30/22-00:55:55.653974
SID:	2025381
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249729802021641 11/30/22-00:55:07.068054
SID:	2021641
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497442025483 11/30/22-00:55:36.086250
SID:	2025483
Source Port:	80
Destination Port:	49744
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802024318 11/30/22-00:55:17.863854
SID:	2024318
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853049532014169 11/30/22-00:55:19.563471
SID:	2014169
Source Port:	53049
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802024313 11/30/22-00:55:17.863854
SID:	2024313
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802024313 11/30/22-00:55:34.401351
SID:	2024313
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497472025483 11/30/22-00:55:41.771804
SID:	2025483
Source Port:	80
Destination Port:	49747
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249744802024318 11/30/22-00:55:34.401351
SID:	2024318
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802021641 11/30/22-00:55:29.247109
SID:	2021641
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249704802825766 11/30/22-00:54:18.966132
SID:	2825766
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249746802025381 11/30/22-00:55:38.275174
SID:	2025381
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249732802021641 11/30/22-00:55:12.457821
SID:	2021641
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249699802024312 11/30/22-00:54:07.324934
SID:	2024312
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802024313 11/30/22-00:54:24.716724
SID:	2024313
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497062025483 11/30/22-00:54:24.053489
SID:	2025483
Source Port:	80
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497502025483 11/30/22-00:55:46.963833
SID:	2025483
Source Port:	80
Destination Port:	49750
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249699802024317 11/30/22-00:54:07.324934
SID:	2024317
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249727802025381 11/30/22-00:55:03.486766
SID:	2025381
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865511532014169 11/30/22-00:55:27.103034
SID:	2014169
Source Port:	65511
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.864967532014169 11/30/22-00:55:58.869049
SID:	2014169
Source Port:	64967
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249721802025381 11/30/22-00:54:53.572062
SID:	2025381
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802024318 11/30/22-00:54:24.716724
SID:	2024318
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802021641 11/30/22-00:54:37.979213
SID:	2021641
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249732802825766 11/30/22-00:55:12.457821
SID:	2825766
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249751802825766 11/30/22-00:55:47.279515
SID:	2825766
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497552025483 11/30/22-00:55:57.270722
SID:	2025483
Source Port:	80
Destination Port:	49755
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497582025483 11/30/22-00:56:00.797031
SID:	2025483
Source Port:	80
Destination Port:	49758
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497362025483 11/30/22-00:55:21.118367
SID:	2025483
Source Port:	80
Destination Port:	49736
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249703802024318 11/30/22-00:54:16.960834
SID:	2024318
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802025381 11/30/22-00:54:14.871390
SID:	2025381
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249703802024313 11/30/22-00:54:16.960834
SID:	2024313
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857134532014169 11/30/22-00:54:31.820802
SID:	2014169
Source Port:	57134
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249758802021641 11/30/22-00:56:00.034214
SID:	2021641
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858691532014169 11/30/22-00:54:53.455722
SID:	2014169
Source Port:	58691
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249736802825766 11/30/22-00:55:19.643476
SID:	2825766
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802025381 11/30/22-00:54:20.168790
SID:	2025381
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497332025483 11/30/22-00:55:15.751744
SID:	2025483
Source Port:	80
Destination Port:	49733
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249745802825766 11/30/22-00:55:36.377571
SID:	2825766
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497032025483 11/30/22-00:54:18.541620
SID:	2025483
Source Port:	80
Destination Port:	49703
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497142025483 11/30/22-00:54:41.602416
SID:	2025483
Source Port:	80
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802024313 11/30/22-00:54:43.829219
SID:	2024313
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859433532014169 11/30/22-00:54:56.376062
SID:	2014169
Source Port:	59433
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802024313 11/30/22-00:55:58.948901
SID:	2024313
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249717802825766 11/30/22-00:54:45.540558
SID:	2825766
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249722802024313 11/30/22-00:54:54.732179
SID:	2024313
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249716802024318 11/30/22-00:54:43.829219
SID:	2024318
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802025381 11/30/22-00:56:01.042444
SID:	2025381
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249757802024318 11/30/22-00:55:58.948901
SID:	2024318
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249723802825766 11/30/22-00:54:56.463103
SID:	2825766
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249718802025381 11/30/22-00:54:47.592007
SID:	2025381
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802025381 11/30/22-00:55:08.823725
SID:	2025381
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249704802021641 11/30/22-00:54:18.966132
SID:	2021641
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249722802024318 11/30/22-00:54:54.732179
SID:	2024318
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249745802021641 11/30/22-00:55:36.377571
SID:	2021641
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249714802024313 11/30/22-00:54:39.977728
SID:	2024313
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249725802825766 11/30/22-00:54:59.930841
SID:	2825766
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249700802025381 11/30/22-00:54:09.487691
SID:	2025381
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249714802024318 11/30/22-00:54:39.977728
SID:	2024318
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.858708532014169 11/30/22-00:55:15.985743
SID:	2014169
Source Port:	58708
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497282025483 11/30/22-00:55:06.759571
SID:	2025483
Source Port:	80
Destination Port:	49728
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249732802024318 11/30/22-00:55:12.457821
SID:	2024318
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249707802825766 11/30/22-00:54:24.716724
SID:	2825766
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497242025483 11/30/22-00:54:59.594972
SID:	2025483
Source Port:	80
Destination Port:	49724
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249732802024313 11/30/22-00:55:12.457821
SID:	2024313
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249708802021641 11/30/22-00:54:26.803652
SID:	2021641
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249724802024318 11/30/22-00:54:58.184483
SID:	2024318
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249759802021641 11/30/22-00:56:01.042444
SID:	2021641
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249751802025381 11/30/22-00:55:47.279515
SID:	2025381
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249724802024313 11/30/22-00:54:58.184483
SID:	2024313
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249710802025381 11/30/22-00:54:31.910937
SID:	2025381
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249715802825766 11/30/22-00:54:42.060768
SID:	2825766
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249747802024318 11/30/22-00:55:40.214633
SID:	2024318
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249747802024313 11/30/22-00:55:40.214633
SID:	2024313
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249719802024313 11/30/22-00:54:49.641508
SID:	2024313
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249743802825766 11/30/22-00:55:32.962709
SID:	2825766
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.857571532014169 11/30/22-00:54:51.528645
SID:	2014169
Source Port:	57571
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249719802024318 11/30/22-00:54:49.641508
SID:	2024318
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249742802024318 11/30/22-00:55:31.101064
SID:	2024318
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.859636532014169 11/30/22-00:54:37.879679
SID:	2014169
Source Port:	59636
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249720802825766 11/30/22-00:54:51.608521
SID:	2825766
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249742802024313 11/30/22-00:55:31.101064
SID:	2024313
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249718802021641 11/30/22-00:54:47.592007
SID:	2021641
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249733802025381 11/30/22-00:55:14.244291
SID:	2025381
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249736802021641 11/30/22-00:55:19.643476
SID:	2021641
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249746802021641 11/30/22-00:55:38.275174
SID:	2021641
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802024318 11/30/22-00:55:16.065951
SID:	2024318
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249723802025381 11/30/22-00:54:56.463103
SID:	2025381
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249748802825766 11/30/22-00:55:42.098367
SID:	2825766
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249737802024313 11/30/22-00:55:21.614296
SID:	2024313
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497562025483 11/30/22-00:55:58.723099
SID:	2025483
Source Port:	80
Destination Port:	49756
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249702802825766 11/30/22-00:54:14.871390
SID:	2825766
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249737802024318 11/30/22-00:55:21.614296
SID:	2024318
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249730802825766 11/30/22-00:55:08.823725
SID:	2825766
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249706802024313 11/30/22-00:54:22.484255
SID:	2024313
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249734802024313 11/30/22-00:55:16.065951
SID:	2024313
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497352025483 11/30/22-00:55:19.347023
SID:	2025483
Source Port:	80
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249706802024318 11/30/22-00:54:22.484255
SID:	2024318
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497522025483 11/30/22-00:55:50.930381
SID:	2025483
Source Port:	80
Destination Port:	49752
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497172025483 11/30/22-00:54:47.032787
SID:	2025483
Source Port:	80
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249733802825766 11/30/22-00:55:14.244291
SID:	2825766
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497392025483 11/30/22-00:55:26.908255
SID:	2025483
Source Port:	80
Destination Port:	49739
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249720802025381 11/30/22-00:54:51.608521
SID:	2025381
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249749802021641 11/30/22-00:55:43.976237
SID:	2021641
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865320532014169 11/30/22-00:54:43.751689
SID:	2014169
Source Port:	65320
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249735802825766 11/30/22-00:55:17.863854
SID:	2825766
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852079532014169 11/30/22-00:55:32.870195
SID:	2014169
Source Port:	52079
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497012025483 11/30/22-00:54:14.085146
SID:	2025483
Source Port:	80
Destination Port:	49701
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249731802025381 11/30/22-00:55:10.632751
SID:	2025381
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249709802024318 11/30/22-00:54:29.164231
SID:	2024318
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249745802024318 11/30/22-00:55:36.377571
SID:	2024318
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249709802024313 11/30/22-00:54:29.164231
SID:	2024313
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802825766 11/30/22-00:54:20.168790
SID:	2825766
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249745802024313 11/30/22-00:55:36.377571
SID:	2024313
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249704802024318 11/30/22-00:54:18.966132
SID:	2024318
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249704802024313 11/30/22-00:54:18.966132
SID:	2024313
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249717802024313 11/30/22-00:54:45.540558
SID:	2024313
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249722802825766 11/30/22-00:54:54.732179
SID:	2825766
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249703802025381 11/30/22-00:54:16.960834
SID:	2025381
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.849302532014169 11/30/22-00:54:20.078245
SID:	2014169
Source Port:	49302
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249711802024313 11/30/22-00:54:33.859062
SID:	2024313
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249728802825766 11/30/22-00:55:05.285201
SID:	2825766
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249705802021641 11/30/22-00:54:20.168790
SID:	2021641
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249711802024318 11/30/22-00:54:33.859062
SID:	2024318
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802021641 11/30/22-00:55:23.450513
SID:	2021641
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865385532014169 11/30/22-00:55:49.289719
SID:	2014169
Source Port:	65385
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249740802825766 11/30/22-00:55:27.193434
SID:	2825766
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497452025483 11/30/22-00:55:37.973570
SID:	2025483
Source Port:	80
Destination Port:	49745
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497462025483 11/30/22-00:55:39.906968
SID:	2025483
Source Port:	80
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497402025483 11/30/22-00:55:28.902821
SID:	2025483
Source Port:	80
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249717802024318 11/30/22-00:54:45.540558
SID:	2024318
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802024313 11/30/22-00:54:12.581436
SID:	2024313
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249738802825766 11/30/22-00:55:23.450513
SID:	2825766
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497132025483 11/30/22-00:54:39.587400
SID:	2025483
Source Port:	80
Destination Port:	49713
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249701802024318 11/30/22-00:54:12.581436
SID:	2024318
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249756802825766 11/30/22-00:55:57.533680
SID:	2825766
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497022025483 11/30/22-00:54:16.469088
SID:	2025483
Source Port:	80
Destination Port:	49702
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249750802825766 11/30/22-00:55:45.758418
SID:	2825766
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249743802021641 11/30/22-00:55:32.962709
SID:	2021641
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249740802021641 11/30/22-00:55:27.193434
SID:	2021641
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249729802025381 11/30/22-00:55:07.068054
SID:	2025381
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802024313 11/30/22-00:55:49.378987
SID:	2024313
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249741802025381 11/30/22-00:55:29.247109
SID:	2025381
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249726802025381 11/30/22-00:55:01.673863
SID:	2025381
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249752802024318 11/30/22-00:55:49.378987
SID:	2024318
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.856042532014169 11/30/22-00:54:35.894646
SID:	2014169
Source Port:	56042
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.853844532014169 11/30/22-00:55:03.396283
SID:	2014169
Source Port:	53844
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.862050532014169 11/30/22-00:54:33.763792
SID:	2014169
Source Port:	62050
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249728802021641 11/30/22-00:55:05.285201
SID:	2021641
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497512025483 11/30/22-00:55:49.068855
SID:	2025483
Source Port:	80
Destination Port:	49751
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249755802024318 11/30/22-00:55:55.653974
SID:	2024318
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497182025483 11/30/22-00:54:49.052316
SID:	2025483
Source Port:	80
Destination Port:	49718
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.852547532014169 11/30/22-00:55:01.596754
SID:	2014169
Source Port:	52547
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249755802024313 11/30/22-00:55:55.653974
SID:	2024313
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249727802024318 11/30/22-00:55:03.486766
SID:	2024318
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249713802025381 11/30/22-00:54:37.979213
SID:	2025381
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249756802021641 11/30/22-00:55:57.533680
SID:	2021641
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.865459532014169 11/30/22-00:55:47.178193
SID:	2014169
Source Port:	65459
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Fake 404 Response - Source IP: 95.213.216.202 - Destination IP: 192.168.2.3

Timestamp:	95.213.216.202192.168.2.380497072025483 11/30/22-00:54:26.372322
SID:	2025483
Source Port:	80
Destination Port:	49707
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249715802021641 11/30/22-00:54:42.060768
SID:	2021641
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249712802825766 11/30/22-00:54:35.972913
SID:	2825766
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249753802825766 11/30/22-00:55:51.242717
SID:	2825766
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query for .su TLD (Soviet Union) Often Malware Related - Source IP: 192.168.2.3 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.38.8.8.854153532014169 11/30/22-00:55:51.152832
SID:	2014169
Source Port:	54153
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249754802025381 11/30/22-00:55:53.496270
SID:	2025381
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.3 - Destination IP: 95.213.216.202

Timestamp:	192.168.2.395.213.216.20249727802024313 11/30/22-00:55:03.486766
SID:	2024313
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: INV.2022LB0362 FORM CO (2).exe	ReversingLabs: Detection: 70%
Source: INV.2022LB0362 FORM CO (2).exe	Virustotal: Detection: 56%			Perma Link

Antivirus detection for URL or domain

Source: http://sempersim.su/gm11/fre.php

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: sempersim.su	Virustotal: Detection: 25%			Perma Link
Source: http://sempersim.su/gm11/fre.php	Virustotal: Detection: 25%			Perma Link

Machine Learning detection for sample

Source: INV.2022LB0362 FORM CO (2).exe

Joe Sandbox ML: detected

Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://sempersim.su/gm11/fre.php"]}

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:49977 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.3:49699 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49699 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49699 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.3:49699 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49699 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57840 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.3:49700 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49700 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49700 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.3:49700 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49700 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57990 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49701 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49701 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49701 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49701 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49701 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49701
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:52387 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49702 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49702 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49702 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49702 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49702 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49702
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:56924 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49703 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49703 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49703 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49703 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49703 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49703
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60625 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49704 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49704 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49704 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49704 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49704 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49704
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:49302 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49705 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49705 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49705 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49705 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49705 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49705
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53975 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49706 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49706 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49706 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49706 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49706 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49706
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:51139 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49707 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49707 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49707 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49707 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49707 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49707
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:52955 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49708 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49708 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49708 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49708 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49708 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49708
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60582 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49709 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49709 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49709 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49709 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49709 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49709
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57134 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49710 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49710 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49710 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49710 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49710 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49710
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:62050 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49711 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49711 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49711 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49711 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49711 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49711
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:56042 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49712 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49712 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49712 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49712 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49712 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49712
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:59636 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49713 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49713 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49713 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49713 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49713 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49713
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:55638 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49714 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49714 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49714 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49714 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49714 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49714
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57704 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49715 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49715 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49715 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49715 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49715 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49715
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65320 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49716 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49716 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49716 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49716 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49716 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49716
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60767 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49717 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49717 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49717 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49717 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49717 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49717
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65107 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49718 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49718 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49718 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49718 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49718 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49718
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53848 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49719 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49719 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49719 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49719 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49719 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49719
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57571 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49720 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49720 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49720 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49720 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49720 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49720
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:58691 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49721 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49721 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49721 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49721 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49721 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49721
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53305 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49722 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49722 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49722 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49722 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49722 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49722
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:59433 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49723 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49723 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49723 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49723 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49723 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49723
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60749 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49724 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49724 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49724 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49724 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49724 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49724
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:56949 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49725 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49725 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49725 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49725 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49725 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49725
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:52547 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49726 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49726 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49726 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49726 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49726 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49726
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53844 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49727 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49727 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49727 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49727 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49727 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49727
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65017 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49728 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49728 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49728 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49728 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49728 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49728
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53466 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49729 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49729 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49729 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49729 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49729 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49729
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:57743 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49730 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49730 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49730 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49730 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49730 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49730
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53623 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49731 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49731 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49731 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49731 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49731 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49731
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:61416 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49732 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49732 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49732 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49732 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49732 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49732
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65196 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49733 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49733 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49733 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49733 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49733 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49733
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:58708 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49734 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49734 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49734 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49734 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49734 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49734
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:59581 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49735 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49735 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49735 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49735 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49735 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49735
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53049 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49736 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49736 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49736 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49736 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49736 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49736
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60088 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49737 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49737 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49737 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49737 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49737 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49737
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:63562 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49738 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49738 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49738 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49738 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49738 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49738
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:53428 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49739 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49739 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49739 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49739 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49739 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49739
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65511 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49740 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49740 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49740 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49740 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49740 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49740
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:59820 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49741 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49741 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49741 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49741 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49741 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49741
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:64595 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49742 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49742 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49742 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49742 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49742 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49742
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:52079 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49743 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49743 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49743 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49743 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49743 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49743
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:64823 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49744 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49744 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49744 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49744 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49744 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49744
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:51992 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49745 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49745 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49745 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49745 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49745 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49745
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:58119 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49746 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49746 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49746 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49746 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49746 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49746
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:49166 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49747 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49747 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49747 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49747 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49747 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49747
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:58301 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49748 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49748 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49748 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49748 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49748 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49748
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:63446 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49749 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49749 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49749 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49749 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49749 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49749
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:49874 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49750 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49750 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49750 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49750 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49750 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49750
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65459 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49751 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49751 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49751 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49751 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49751 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49751
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:65385 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49752 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49752 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49752 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49752 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49752 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49752
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:54153 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49753 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49753 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49753 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49753 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49753 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49753
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:64602 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49754 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49754 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49754 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49754 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49754 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49754
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:50784 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49755 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49755 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49755 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49755 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49755 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49755
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:64121 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49756 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49756 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49756 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49756 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49756 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49756
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:64967 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49757 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49757 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49757 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49757 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49757 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49757
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:60825 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49758 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49758 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49758 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49758 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49758 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49758
Source: Traffic	Snort IDS: 2014169 ET DNS Query for .su TLD (Soviet Union) Often Malware Related 192.168.2.3:49201 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.3:49759 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.3:49759 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.3:49759 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.3:49759 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.3:49759 -> 95.213.216.202:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 95.213.216.202:80 -> 192.168.2.3:49759

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: http://sempersim.su/gm11/fre.php

Source: Joe Sandbox View

ASN Name: SELECTELRU SELECTELRU

Source: Joe Sandbox View

IP Address: 95.213.216.202 95.213.216.202

Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 190Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close
Source: global traffic	HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 163Connection: close

Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000003.00000002.506023871.000000000049F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://sempersim.su/gm11/fre.php
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Source: unknown

HTTP traffic detected: POST /gm11/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: sempersim.suAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B40C7D1CContent-Length: 190Connection: close

Source: unknown

DNS traffic detected: queries for: sempersim.su

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.255040267.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.255040267.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Code function: 0_2_00FAC164
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Code function: 0_2_00FAE5B0
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Code function: 0_2_00FAE5A0

Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000000.239185933.00000000004A6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemyHA.exeJ vs INV.2022LB0362 FORM CO (2).exe
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.265282526.0000000007150000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCollins.dll8 vs INV.2022LB0362 FORM CO (2).exe
Source: INV.2022LB0362 FORM CO (2).exe	Binary or memory string: OriginalFilenamemyHA.exeJ vs INV.2022LB0362 FORM CO (2).exe

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: INV.2022LB0362 FORM CO (2).exe	ReversingLabs: Detection: 70%
Source: INV.2022LB0362 FORM CO (2).exe	Virustotal: Detection: 56%

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INV.2022LB0362 FORM CO (2).exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@61/1

Source: INV.2022LB0362 FORM CO (2).exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Yara detected aPLib compressed binary

Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132, type: MEMORYSTR

.NET source code contains potential unpacker

Source: INV.2022LB0362 FORM CO (2).exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.INV.2022LB0362 FORM CO (2).exe.3d0000.0.unpack, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: INV.2022LB0362 FORM CO (2).exe

Static PE information: 0xDBD76B81 [Sat Nov 16 23:34:25 2086 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.568253289628953

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe TID: 6096	Thread sleep time: -42186s >= -30000s
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe TID: 6068	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe TID: 6128	Thread sleep time: -480000s >= -30000s

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Thread delayed: delay time: 42186
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Thread delayed: delay time: 60000

Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Process created: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: INV.2022LB0362 FORM CO (2).exe PID: 6132, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000003.00000002.506514782.0000000001238000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.INV.2022LB0362 FORM CO (2).exe.2be79e0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	11 Process Injection	1 Masquerading	2 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Email Collection	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	Automated Exfiltration	112 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	12 Software Packing	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Timestomp	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
INV.2022LB0362 FORM CO (2).exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
INV.2022LB0362 FORM CO (2).exe	56%	Virustotal		Browse
INV.2022LB0362 FORM CO (2).exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.INV.2022LB0362 FORM CO (2).exe.3f9bcd8.14.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.0.INV.2022LB0362 FORM CO (2).exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.INV.2022LB0362 FORM CO (2).exe.3f81cb8.13.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
sempersim.su	25%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://alphastand.top/alien/fre.php	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://alphastand.win/alien/fre.php	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://sempersim.su/gm11/fre.php	25%	Virustotal		Browse
http://sempersim.su/gm11/fre.php	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sempersim.su	95.213.216.202	true	true	25%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://kbfvzoboss.bid/alien/fre.php	true	URL Reputation: safe URL Reputation: safe	unknown
http://alphastand.top/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.win/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.trade/alien/fre.php	true	URL Reputation: safe	unknown
http://sempersim.su/gm11/fre.php	true	25%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ibsensoftware.com/	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, INV.2022LB0362 FORM CO (2).exe, 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	INV.2022LB0362 FORM CO (2).exe, 00000000.00000002.263729189.0000000006AF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
95.213.216.202	sempersim.su	Russian Federation		49505	SELECTELRU	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756310
Start date and time:	2022-11-30 00:53:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	INV.2022LB0362 FORM CO (2).exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@61/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
HTTP Packets have been reduced
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 8.238.190.126, 8.241.126.249, 8.241.121.126, 8.253.204.249, 8.253.204.120
Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, fs.microsoft.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:54:02	API Interceptor	59x Sleep call for process: INV.2022LB0362 FORM CO (2).exe modified

Process:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck

Download File

Process:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D898504A722BFF1524134C6AB6A5EAA5
SHA1:	E0FDC90C2CA2A0219C99D2758E68C18875A3E11E
SHA-256:	878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9
SHA-512:	26A4398BFFB0C0AEF9A6EC53CD3367A2D0ABF2F70097F711BBBF1E9E32FD9F1A72121691BB6A39EEB55D596EDD527934E541B4DEFB3B1426B1D1A6429804DC61
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..............................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.565543571702018
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	INV.2022LB0362 FORM CO (2).exe
File size:	865280
MD5:	baed30aea51e6000571219633aa745b0
SHA1:	d7e3b155c00245a7f867dd2fb4c06cb7be6ec3f7
SHA256:	57520e51bb0820741b7883926800223886c491a8a5ddd517a49b0e2cc752fb18
SHA512:	4f19e423fc1bdbba152a570e5382bd2eabdf04ca335cdc1ed286287740c153c7a34d3a661abaf01f124870f9bd3de2e9321e66114f5bedea16131bd77de2b786
SSDEEP:	24576:GM+L74mBfNUstzoB1ERZcSMI2PmVl9kiYxM9aE3r8JN:F+RiSMHmgu9HI
TLSH:	91054A4F2B7FDEF0EA245CFB221457039D3651DABA8BCA7883984BC660F161C5B74864
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....k................0..*..........vH... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4d4876
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDBD76B81 [Sat Nov 16 23:34:25 2086 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd4824	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd6000	0x5cc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd4808	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd287c	0xd2a00	False	0.8132742952522255	data	7.568253289628953	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd6000	0x5cc	0x600	False	0.4264322916666667	data	4.114856973981248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd8000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xd6090	0x33c	data
RT_MANIFEST	0xd63dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.395.213.216.20249705802024318 11/30/22-00:54:20.168790	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49705	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249702802021641 11/30/22-00:54:14.871390	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49702	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249738802024313 11/30/22-00:55:23.450513	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49738	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249734802825766 11/30/22-00:55:16.065951	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49734	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497272025483 11/30/22-00:55:04.982566	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49727	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249741802024313 11/30/22-00:55:29.247109	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49741	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249701802825766 11/30/22-00:54:12.581436	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49701	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249749802025381 11/30/22-00:55:43.976237	TCP	2025381	ET TROJAN LokiBot Checkin	49749	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249759802825766 11/30/22-00:56:01.042444	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49759	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249738802024318 11/30/22-00:55:23.450513	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49738	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249735802021641 11/30/22-00:55:17.863854	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49735	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249705802024313 11/30/22-00:54:20.168790	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49705	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249741802024318 11/30/22-00:55:29.247109	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49741	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497232025483 11/30/22-00:54:57.894669	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49723	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249752802025381 11/30/22-00:55:49.378987	TCP	2025381	ET TROJAN LokiBot Checkin	49752	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249716802025381 11/30/22-00:54:43.829219	TCP	2025381	ET TROJAN LokiBot Checkin	49716	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249707802021641 11/30/22-00:54:24.716724	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49707	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249757802025381 11/30/22-00:55:58.948901	TCP	2025381	ET TROJAN LokiBot Checkin	49757	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249730802021641 11/30/22-00:55:08.823725	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49730	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.861416532014169 11/30/22-00:55:12.379224	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	61416	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860088532014169 11/30/22-00:55:21.529314	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60088	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249713802024313 11/30/22-00:54:37.979213	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49713	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249726802825766 11/30/22-00:55:01.673863	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49726	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249713802024318 11/30/22-00:54:37.979213	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49713	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.857743532014169 11/30/22-00:55:08.735474	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57743	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249754802825766 11/30/22-00:55:53.496270	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49754	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497572025483 11/30/22-00:55:59.773200	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49757	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249744802025381 11/30/22-00:55:34.401351	TCP	2025381	ET TROJAN LokiBot Checkin	49744	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.859820532014169 11/30/22-00:55:29.162121	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	59820	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853305532014169 11/30/22-00:54:54.648302	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53305	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497532025483 11/30/22-00:55:52.887247	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49753	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249708802025381 11/30/22-00:54:26.803652	TCP	2025381	ET TROJAN LokiBot Checkin	49708	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497162025483 11/30/22-00:54:45.204539	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49716	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497382025483 11/30/22-00:55:24.982216	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49738	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249758802024313 11/30/22-00:56:00.034214	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49758	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249755802021641 11/30/22-00:55:55.653974	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49755	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497302025483 11/30/22-00:55:10.337695	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49730	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497342025483 11/30/22-00:55:17.565495	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49734	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249758802024318 11/30/22-00:56:00.034214	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49758	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.852387532014169 11/30/22-00:54:14.412323	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	52387	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249721802024318 11/30/22-00:54:53.572062	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49721	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249727802021641 11/30/22-00:55:03.486766	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49727	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249750802021641 11/30/22-00:55:45.758418	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49750	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497122025483 11/30/22-00:54:37.552263	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49712	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249718802825766 11/30/22-00:54:47.592007	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49718	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.851992532014169 11/30/22-00:55:36.286012	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	51992	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860625532014169 11/30/22-00:54:18.863516	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60625	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249736802025381 11/30/22-00:55:19.643476	TCP	2025381	ET TROJAN LokiBot Checkin	49736	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249721802024313 11/30/22-00:54:53.572062	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49721	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249746802825766 11/30/22-00:55:38.275174	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49746	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249722802021641 11/30/22-00:54:54.732179	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49722	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249699802025381 11/30/22-00:54:07.324934	TCP	2025381	ET TROJAN LokiBot Checkin	49699	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249714802021641 11/30/22-00:54:39.977728	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49714	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497492025483 11/30/22-00:55:45.483574	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49749	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249712802025381 11/30/22-00:54:35.972913	TCP	2025381	ET TROJAN LokiBot Checkin	49712	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.857840532014169 11/30/22-00:54:09.401173	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57840	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.858301532014169 11/30/22-00:55:42.001541	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	58301	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249740802025381 11/30/22-00:55:27.193434	TCP	2025381	ET TROJAN LokiBot Checkin	49740	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497422025483 11/30/22-00:55:32.668199	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49742	95.213.216.202	192.168.2.3
192.168.2.38.8.8.863562532014169 11/30/22-00:55:23.368358	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	63562	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497412025483 11/30/22-00:55:30.821604	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49741	95.213.216.202	192.168.2.3
192.168.2.38.8.8.850784532014169 11/30/22-00:55:55.557056	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	50784	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249723802021641 11/30/22-00:54:56.463103	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49723	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249713802825766 11/30/22-00:54:37.979213	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49713	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249726802024313 11/30/22-00:55:01.673863	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49726	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249728802025381 11/30/22-00:55:05.285201	TCP	2025381	ET TROJAN LokiBot Checkin	49728	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249726802024318 11/30/22-00:55:01.673863	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49726	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249737802025381 11/30/22-00:55:21.614296	TCP	2025381	ET TROJAN LokiBot Checkin	49737	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497112025483 11/30/22-00:54:35.462242	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49711	95.213.216.202	192.168.2.3
192.168.2.38.8.8.856949532014169 11/30/22-00:54:59.841953	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	56949	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249753802024318 11/30/22-00:55:51.242717	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49753	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249753802024313 11/30/22-00:55:51.242717	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49753	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497082025483 11/30/22-00:54:28.382639	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49708	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249714802825766 11/30/22-00:54:39.977728	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49714	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249725802024313 11/30/22-00:54:59.930841	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49725	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249756802025381 11/30/22-00:55:57.533680	TCP	2025381	ET TROJAN LokiBot Checkin	49756	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.860825532014169 11/30/22-00:55:59.940841	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60825	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249754802024313 11/30/22-00:55:53.496270	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49754	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249748802021641 11/30/22-00:55:42.098367	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49748	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249725802024318 11/30/22-00:54:59.930841	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49725	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249742802021641 11/30/22-00:55:31.101064	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49742	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249755802825766 11/30/22-00:55:55.653974	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49755	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249754802024318 11/30/22-00:55:53.496270	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49754	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249709802025381 11/30/22-00:54:29.164231	TCP	2025381	ET TROJAN LokiBot Checkin	49709	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.849977532014169 11/30/22-00:54:06.875981	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	49977	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.856924532014169 11/30/22-00:54:16.879287	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	56924	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249700802024317 11/30/22-00:54:09.487691	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49700	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249739802825766 11/30/22-00:55:25.267085	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49739	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.860582532014169 11/30/22-00:54:28.778637	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60582	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497192025483 11/30/22-00:54:51.280995	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49719	95.213.216.202	192.168.2.3
192.168.2.38.8.8.864595532014169 11/30/22-00:55:31.020256	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	64595	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249742802825766 11/30/22-00:55:31.101064	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49742	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249700802024312 11/30/22-00:54:09.487691	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49700	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249711802025381 11/30/22-00:54:33.859062	TCP	2025381	ET TROJAN LokiBot Checkin	49711	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.860767532014169 11/30/22-00:54:45.460012	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60767	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249739802021641 11/30/22-00:55:25.267085	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49739	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249724802025381 11/30/22-00:54:58.184483	TCP	2025381	ET TROJAN LokiBot Checkin	49724	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249751802021641 11/30/22-00:55:47.279515	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49751	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249758802825766 11/30/22-00:56:00.034214	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49758	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249710802021641 11/30/22-00:54:31.910937	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49710	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249711802021641 11/30/22-00:54:33.859062	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49711	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.849201532014169 11/30/22-00:56:00.958664	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	49201	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249729802024313 11/30/22-00:55:07.068054	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49729	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249758802025381 11/30/22-00:56:00.034214	TCP	2025381	ET TROJAN LokiBot Checkin	49758	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497262025483 11/30/22-00:55:03.204141	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49726	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249743802025381 11/30/22-00:55:32.962709	TCP	2025381	ET TROJAN LokiBot Checkin	49743	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249729802024318 11/30/22-00:55:07.068054	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49729	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249744802021641 11/30/22-00:55:34.401351	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49744	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249726802021641 11/30/22-00:55:01.673863	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49726	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249750802024313 11/30/22-00:55:45.758418	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49750	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249710802825766 11/30/22-00:54:31.910937	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49710	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497222025483 11/30/22-00:54:56.166551	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49722	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249750802024318 11/30/22-00:55:45.758418	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49750	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249699802021641 11/30/22-00:54:07.324934	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49699	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497202025483 11/30/22-00:54:53.259308	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49720	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249701802021641 11/30/22-00:54:12.581436	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49701	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.853623532014169 11/30/22-00:55:10.547934	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53623	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249754802021641 11/30/22-00:55:53.496270	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49754	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249715802025381 11/30/22-00:54:42.060768	TCP	2025381	ET TROJAN LokiBot Checkin	49715	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.852955532014169 11/30/22-00:54:26.705694	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	52955	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249740802024313 11/30/22-00:55:27.193434	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49740	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249740802024318 11/30/22-00:55:27.193434	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49740	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249738802025381 11/30/22-00:55:23.450513	TCP	2025381	ET TROJAN LokiBot Checkin	49738	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249731802021641 11/30/22-00:55:10.632751	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49731	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249752802021641 11/30/22-00:55:49.378987	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49752	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249703802021641 11/30/22-00:54:16.960834	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49703	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249712802024313 11/30/22-00:54:35.972913	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49712	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249727802825766 11/30/22-00:55:03.486766	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49727	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249717802025381 11/30/22-00:54:45.540558	TCP	2025381	ET TROJAN LokiBot Checkin	49717	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.859581532014169 11/30/22-00:55:17.784201	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	59581	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249712802024318 11/30/22-00:54:35.972913	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49712	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497312025483 11/30/22-00:55:12.166821	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49731	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249739802024313 11/30/22-00:55:25.267085	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49739	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249725802025381 11/30/22-00:54:59.930841	TCP	2025381	ET TROJAN LokiBot Checkin	49725	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.849166532014169 11/30/22-00:55:40.126118	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	49166	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.860749532014169 11/30/22-00:54:58.103973	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	60749	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497052025483 11/30/22-00:54:21.783216	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49705	95.213.216.202	192.168.2.3
192.168.2.38.8.8.853975532014169 11/30/22-00:54:22.160619	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53975	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249753802025381 11/30/22-00:55:51.242717	TCP	2025381	ET TROJAN LokiBot Checkin	49753	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249757802021641 11/30/22-00:55:58.948901	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49757	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249716802021641 11/30/22-00:54:43.829219	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49716	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249739802024318 11/30/22-00:55:25.267085	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49739	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249741802825766 11/30/22-00:55:29.247109	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49741	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249700802825766 11/30/22-00:54:09.487691	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49700	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249720802024313 11/30/22-00:54:51.608521	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49720	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249708802024318 11/30/22-00:54:26.803652	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49708	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497482025483 11/30/22-00:55:43.661913	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49748	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249731802825766 11/30/22-00:55:10.632751	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49731	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249702802024313 11/30/22-00:54:14.871390	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49702	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249720802024318 11/30/22-00:54:51.608521	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49720	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249737802825766 11/30/22-00:55:21.614296	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49737	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249702802024318 11/30/22-00:54:14.871390	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49702	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249719802825766 11/30/22-00:54:49.641508	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49719	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.863446532014169 11/30/22-00:55:43.898414	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	63446	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497092025483 11/30/22-00:54:30.691043	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49709	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497432025483 11/30/22-00:55:34.122250	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49743	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249708802024313 11/30/22-00:54:26.803652	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49708	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.858119532014169 11/30/22-00:55:38.197046	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	58119	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.857990532014169 11/30/22-00:54:11.706174	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57990	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249759802024318 11/30/22-00:56:01.042444	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49759	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249709802825766 11/30/22-00:54:29.164231	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49709	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249730802024313 11/30/22-00:55:08.823725	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49730	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249745802025381 11/30/22-00:55:36.377571	TCP	2025381	ET TROJAN LokiBot Checkin	49745	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249724802021641 11/30/22-00:54:58.184483	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49724	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249759802024313 11/30/22-00:56:01.042444	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49759	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249703802825766 11/30/22-00:54:16.960834	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49703	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249704802025381 11/30/22-00:54:18.966132	TCP	2025381	ET TROJAN LokiBot Checkin	49704	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497152025483 11/30/22-00:54:43.541337	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49715	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249730802024318 11/30/22-00:55:08.823725	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49730	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249718802024318 11/30/22-00:54:47.592007	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49718	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.864121532014169 11/30/22-00:55:57.444180	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	64121	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249719802021641 11/30/22-00:54:49.641508	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49719	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249721802825766 11/30/22-00:54:53.572062	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49721	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497042025483 11/30/22-00:54:19.714505	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49704	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249747802021641 11/30/22-00:55:40.214633	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49747	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.849874532014169 11/30/22-00:55:45.675021	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	49874	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249722802025381 11/30/22-00:54:54.732179	TCP	2025381	ET TROJAN LokiBot Checkin	49722	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249718802024313 11/30/22-00:54:47.592007	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49718	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.853428532014169 11/30/22-00:55:25.189214	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53428	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249736802024318 11/30/22-00:55:19.643476	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49736	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249736802024313 11/30/22-00:55:19.643476	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49736	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249732802025381 11/30/22-00:55:12.457821	TCP	2025381	ET TROJAN LokiBot Checkin	49732	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497592025483 11/30/22-00:56:01.793951	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49759	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249746802024318 11/30/22-00:55:38.275174	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49746	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249749802024318 11/30/22-00:55:43.976237	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49749	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249737802021641 11/30/22-00:55:21.614296	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49737	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249746802024313 11/30/22-00:55:38.275174	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49746	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497542025483 11/30/22-00:55:55.161061	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49754	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249735802025381 11/30/22-00:55:17.863854	TCP	2025381	ET TROJAN LokiBot Checkin	49735	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249706802021641 11/30/22-00:54:22.484255	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49706	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249734802021641 11/30/22-00:55:16.065951	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49734	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249699802825766 11/30/22-00:54:07.324934	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49699	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497322025483 11/30/22-00:55:13.950022	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49732	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497372025483 11/30/22-00:55:23.147009	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49737	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249749802024313 11/30/22-00:55:43.976237	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49749	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249748802025381 11/30/22-00:55:42.098367	TCP	2025381	ET TROJAN LokiBot Checkin	49748	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497212025483 11/30/22-00:54:54.418787	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49721	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497102025483 11/30/22-00:54:33.459515	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49710	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249733802024313 11/30/22-00:55:14.244291	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49733	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249707802025381 11/30/22-00:54:24.716724	TCP	2025381	ET TROJAN LokiBot Checkin	49707	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249733802024318 11/30/22-00:55:14.244291	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49733	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.851139532014169 11/30/22-00:54:24.370686	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	51139	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249721802021641 11/30/22-00:54:53.572062	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49721	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249747802825766 11/30/22-00:55:40.214633	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49747	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249706802825766 11/30/22-00:54:22.484255	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49706	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249709802021641 11/30/22-00:54:29.164231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49709	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.855638532014169 11/30/22-00:54:39.891168	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	55638	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853466532014169 11/30/22-00:55:06.970990	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53466	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249717802021641 11/30/22-00:54:45.540558	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49717	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.864823532014169 11/30/22-00:55:34.318234	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	64823	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249706802025381 11/30/22-00:54:22.484255	TCP	2025381	ET TROJAN LokiBot Checkin	49706	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249716802825766 11/30/22-00:54:43.829219	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49716	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249720802021641 11/30/22-00:54:51.608521	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49720	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865017532014169 11/30/22-00:55:05.186135	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65017	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249734802025381 11/30/22-00:55:16.065951	TCP	2025381	ET TROJAN LokiBot Checkin	49734	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249723802024318 11/30/22-00:54:56.463103	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49723	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.864602532014169 11/30/22-00:55:53.393350	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	64602	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497252025483 11/30/22-00:55:01.390776	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49725	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497292025483 11/30/22-00:55:08.539654	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49729	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249723802024313 11/30/22-00:54:56.463103	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49723	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.853848532014169 11/30/22-00:54:49.539403	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53848	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249744802825766 11/30/22-00:55:34.401351	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49744	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865107532014169 11/30/22-00:54:47.470066	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65107	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249739802025381 11/30/22-00:55:25.267085	TCP	2025381	ET TROJAN LokiBot Checkin	49739	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249712802021641 11/30/22-00:54:35.972913	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49712	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249753802021641 11/30/22-00:55:51.242717	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49753	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249725802021641 11/30/22-00:54:59.930841	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49725	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249748802024318 11/30/22-00:55:42.098367	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49748	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249731802024313 11/30/22-00:55:10.632751	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49731	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249748802024313 11/30/22-00:55:42.098367	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49748	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865196532014169 11/30/22-00:55:14.166464	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65196	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249731802024318 11/30/22-00:55:10.632751	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49731	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249708802825766 11/30/22-00:54:26.803652	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49708	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249749802825766 11/30/22-00:55:43.976237	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49749	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249743802024313 11/30/22-00:55:32.962709	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49743	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249757802825766 11/30/22-00:55:58.948901	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49757	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249743802024318 11/30/22-00:55:32.962709	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49743	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249728802024318 11/30/22-00:55:05.285201	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49728	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249750802025381 11/30/22-00:55:45.758418	TCP	2025381	ET TROJAN LokiBot Checkin	49750	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249700802021641 11/30/22-00:54:09.487691	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49700	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249728802024313 11/30/22-00:55:05.285201	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49728	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249714802025381 11/30/22-00:54:39.977728	TCP	2025381	ET TROJAN LokiBot Checkin	49714	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249724802825766 11/30/22-00:54:58.184483	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49724	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249719802025381 11/30/22-00:54:49.641508	TCP	2025381	ET TROJAN LokiBot Checkin	49719	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249756802024318 11/30/22-00:55:57.533680	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49756	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249742802025381 11/30/22-00:55:31.101064	TCP	2025381	ET TROJAN LokiBot Checkin	49742	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249733802021641 11/30/22-00:55:14.244291	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49733	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249729802825766 11/30/22-00:55:07.068054	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49729	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.857704532014169 11/30/22-00:54:41.979608	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57704	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249715802024318 11/30/22-00:54:42.060768	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49715	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249752802825766 11/30/22-00:55:49.378987	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49752	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249756802024313 11/30/22-00:55:57.533680	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49756	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249715802024313 11/30/22-00:54:42.060768	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49715	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249751802024313 11/30/22-00:55:47.279515	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49751	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249711802825766 11/30/22-00:54:33.859062	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49711	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249751802024318 11/30/22-00:55:47.279515	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49751	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249710802024318 11/30/22-00:54:31.910937	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49710	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249710802024313 11/30/22-00:54:31.910937	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49710	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249747802025381 11/30/22-00:55:40.214633	TCP	2025381	ET TROJAN LokiBot Checkin	49747	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249701802025381 11/30/22-00:54:12.581436	TCP	2025381	ET TROJAN LokiBot Checkin	49701	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249755802025381 11/30/22-00:55:55.653974	TCP	2025381	ET TROJAN LokiBot Checkin	49755	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249729802021641 11/30/22-00:55:07.068054	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49729	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497442025483 11/30/22-00:55:36.086250	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49744	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249735802024318 11/30/22-00:55:17.863854	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49735	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.853049532014169 11/30/22-00:55:19.563471	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53049	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249735802024313 11/30/22-00:55:17.863854	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49735	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249744802024313 11/30/22-00:55:34.401351	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49744	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497472025483 11/30/22-00:55:41.771804	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49747	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249744802024318 11/30/22-00:55:34.401351	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49744	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249741802021641 11/30/22-00:55:29.247109	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49741	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249704802825766 11/30/22-00:54:18.966132	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49704	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249746802025381 11/30/22-00:55:38.275174	TCP	2025381	ET TROJAN LokiBot Checkin	49746	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249732802021641 11/30/22-00:55:12.457821	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49732	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249699802024312 11/30/22-00:54:07.324934	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49699	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249707802024313 11/30/22-00:54:24.716724	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49707	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497062025483 11/30/22-00:54:24.053489	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49706	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497502025483 11/30/22-00:55:46.963833	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49750	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249699802024317 11/30/22-00:54:07.324934	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49699	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249727802025381 11/30/22-00:55:03.486766	TCP	2025381	ET TROJAN LokiBot Checkin	49727	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865511532014169 11/30/22-00:55:27.103034	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65511	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.864967532014169 11/30/22-00:55:58.869049	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	64967	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249721802025381 11/30/22-00:54:53.572062	TCP	2025381	ET TROJAN LokiBot Checkin	49721	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249707802024318 11/30/22-00:54:24.716724	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49707	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249713802021641 11/30/22-00:54:37.979213	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49713	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249732802825766 11/30/22-00:55:12.457821	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49732	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249751802825766 11/30/22-00:55:47.279515	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49751	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497552025483 11/30/22-00:55:57.270722	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49755	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497582025483 11/30/22-00:56:00.797031	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49758	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497362025483 11/30/22-00:55:21.118367	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49736	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249703802024318 11/30/22-00:54:16.960834	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49703	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249702802025381 11/30/22-00:54:14.871390	TCP	2025381	ET TROJAN LokiBot Checkin	49702	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249703802024313 11/30/22-00:54:16.960834	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49703	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.857134532014169 11/30/22-00:54:31.820802	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57134	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249758802021641 11/30/22-00:56:00.034214	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49758	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.858691532014169 11/30/22-00:54:53.455722	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	58691	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249736802825766 11/30/22-00:55:19.643476	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49736	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249705802025381 11/30/22-00:54:20.168790	TCP	2025381	ET TROJAN LokiBot Checkin	49705	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497332025483 11/30/22-00:55:15.751744	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49733	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249745802825766 11/30/22-00:55:36.377571	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49745	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497032025483 11/30/22-00:54:18.541620	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49703	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497142025483 11/30/22-00:54:41.602416	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49714	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249716802024313 11/30/22-00:54:43.829219	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49716	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.859433532014169 11/30/22-00:54:56.376062	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	59433	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249757802024313 11/30/22-00:55:58.948901	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49757	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249717802825766 11/30/22-00:54:45.540558	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49717	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249722802024313 11/30/22-00:54:54.732179	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49722	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249716802024318 11/30/22-00:54:43.829219	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49716	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249759802025381 11/30/22-00:56:01.042444	TCP	2025381	ET TROJAN LokiBot Checkin	49759	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249757802024318 11/30/22-00:55:58.948901	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49757	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249723802825766 11/30/22-00:54:56.463103	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49723	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249718802025381 11/30/22-00:54:47.592007	TCP	2025381	ET TROJAN LokiBot Checkin	49718	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249730802025381 11/30/22-00:55:08.823725	TCP	2025381	ET TROJAN LokiBot Checkin	49730	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249704802021641 11/30/22-00:54:18.966132	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49704	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249722802024318 11/30/22-00:54:54.732179	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49722	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249745802021641 11/30/22-00:55:36.377571	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49745	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249714802024313 11/30/22-00:54:39.977728	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49714	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249725802825766 11/30/22-00:54:59.930841	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49725	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249700802025381 11/30/22-00:54:09.487691	TCP	2025381	ET TROJAN LokiBot Checkin	49700	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249714802024318 11/30/22-00:54:39.977728	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49714	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.858708532014169 11/30/22-00:55:15.985743	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	58708	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497282025483 11/30/22-00:55:06.759571	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49728	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249732802024318 11/30/22-00:55:12.457821	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49732	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249707802825766 11/30/22-00:54:24.716724	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49707	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497242025483 11/30/22-00:54:59.594972	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49724	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249732802024313 11/30/22-00:55:12.457821	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49732	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249708802021641 11/30/22-00:54:26.803652	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49708	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249724802024318 11/30/22-00:54:58.184483	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49724	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249759802021641 11/30/22-00:56:01.042444	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49759	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249751802025381 11/30/22-00:55:47.279515	TCP	2025381	ET TROJAN LokiBot Checkin	49751	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249724802024313 11/30/22-00:54:58.184483	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49724	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249710802025381 11/30/22-00:54:31.910937	TCP	2025381	ET TROJAN LokiBot Checkin	49710	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249715802825766 11/30/22-00:54:42.060768	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49715	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249747802024318 11/30/22-00:55:40.214633	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49747	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249747802024313 11/30/22-00:55:40.214633	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49747	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249719802024313 11/30/22-00:54:49.641508	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49719	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249743802825766 11/30/22-00:55:32.962709	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49743	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.857571532014169 11/30/22-00:54:51.528645	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	57571	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249719802024318 11/30/22-00:54:49.641508	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49719	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249742802024318 11/30/22-00:55:31.101064	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49742	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.859636532014169 11/30/22-00:54:37.879679	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	59636	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249720802825766 11/30/22-00:54:51.608521	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49720	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249742802024313 11/30/22-00:55:31.101064	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49742	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249718802021641 11/30/22-00:54:47.592007	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49718	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249733802025381 11/30/22-00:55:14.244291	TCP	2025381	ET TROJAN LokiBot Checkin	49733	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249736802021641 11/30/22-00:55:19.643476	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49736	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249746802021641 11/30/22-00:55:38.275174	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49746	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249734802024318 11/30/22-00:55:16.065951	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49734	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249723802025381 11/30/22-00:54:56.463103	TCP	2025381	ET TROJAN LokiBot Checkin	49723	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249748802825766 11/30/22-00:55:42.098367	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49748	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249737802024313 11/30/22-00:55:21.614296	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49737	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497562025483 11/30/22-00:55:58.723099	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49756	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249702802825766 11/30/22-00:54:14.871390	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49702	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249737802024318 11/30/22-00:55:21.614296	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49737	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249730802825766 11/30/22-00:55:08.823725	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49730	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249706802024313 11/30/22-00:54:22.484255	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49706	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249734802024313 11/30/22-00:55:16.065951	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49734	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497352025483 11/30/22-00:55:19.347023	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49735	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249706802024318 11/30/22-00:54:22.484255	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49706	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497522025483 11/30/22-00:55:50.930381	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49752	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497172025483 11/30/22-00:54:47.032787	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49717	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249733802825766 11/30/22-00:55:14.244291	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49733	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497392025483 11/30/22-00:55:26.908255	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49739	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249720802025381 11/30/22-00:54:51.608521	TCP	2025381	ET TROJAN LokiBot Checkin	49720	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249749802021641 11/30/22-00:55:43.976237	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49749	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865320532014169 11/30/22-00:54:43.751689	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65320	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249735802825766 11/30/22-00:55:17.863854	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49735	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.852079532014169 11/30/22-00:55:32.870195	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	52079	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497012025483 11/30/22-00:54:14.085146	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49701	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249731802025381 11/30/22-00:55:10.632751	TCP	2025381	ET TROJAN LokiBot Checkin	49731	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249709802024318 11/30/22-00:54:29.164231	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49709	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249745802024318 11/30/22-00:55:36.377571	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49745	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249709802024313 11/30/22-00:54:29.164231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49709	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249705802825766 11/30/22-00:54:20.168790	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49705	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249745802024313 11/30/22-00:55:36.377571	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49745	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249704802024318 11/30/22-00:54:18.966132	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49704	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249704802024313 11/30/22-00:54:18.966132	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49704	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249717802024313 11/30/22-00:54:45.540558	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49717	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249722802825766 11/30/22-00:54:54.732179	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49722	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249703802025381 11/30/22-00:54:16.960834	TCP	2025381	ET TROJAN LokiBot Checkin	49703	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.849302532014169 11/30/22-00:54:20.078245	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	49302	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249711802024313 11/30/22-00:54:33.859062	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49711	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249728802825766 11/30/22-00:55:05.285201	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49728	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249705802021641 11/30/22-00:54:20.168790	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49705	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249711802024318 11/30/22-00:54:33.859062	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49711	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249738802021641 11/30/22-00:55:23.450513	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49738	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865385532014169 11/30/22-00:55:49.289719	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65385	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249740802825766 11/30/22-00:55:27.193434	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49740	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497452025483 11/30/22-00:55:37.973570	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49745	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497462025483 11/30/22-00:55:39.906968	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49746	95.213.216.202	192.168.2.3
95.213.216.202192.168.2.380497402025483 11/30/22-00:55:28.902821	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49740	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249717802024318 11/30/22-00:54:45.540558	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49717	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249701802024313 11/30/22-00:54:12.581436	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49701	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249738802825766 11/30/22-00:55:23.450513	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49738	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497132025483 11/30/22-00:54:39.587400	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49713	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249701802024318 11/30/22-00:54:12.581436	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49701	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249756802825766 11/30/22-00:55:57.533680	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49756	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497022025483 11/30/22-00:54:16.469088	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49702	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249750802825766 11/30/22-00:55:45.758418	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49750	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249743802021641 11/30/22-00:55:32.962709	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49743	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249740802021641 11/30/22-00:55:27.193434	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49740	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249729802025381 11/30/22-00:55:07.068054	TCP	2025381	ET TROJAN LokiBot Checkin	49729	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249752802024313 11/30/22-00:55:49.378987	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49752	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249741802025381 11/30/22-00:55:29.247109	TCP	2025381	ET TROJAN LokiBot Checkin	49741	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249726802025381 11/30/22-00:55:01.673863	TCP	2025381	ET TROJAN LokiBot Checkin	49726	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249752802024318 11/30/22-00:55:49.378987	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49752	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.856042532014169 11/30/22-00:54:35.894646	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	56042	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.853844532014169 11/30/22-00:55:03.396283	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	53844	53	192.168.2.3	8.8.8.8
192.168.2.38.8.8.862050532014169 11/30/22-00:54:33.763792	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	62050	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249728802021641 11/30/22-00:55:05.285201	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49728	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497512025483 11/30/22-00:55:49.068855	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49751	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249755802024318 11/30/22-00:55:55.653974	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49755	80	192.168.2.3	95.213.216.202
95.213.216.202192.168.2.380497182025483 11/30/22-00:54:49.052316	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49718	95.213.216.202	192.168.2.3
192.168.2.38.8.8.852547532014169 11/30/22-00:55:01.596754	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	52547	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249755802024313 11/30/22-00:55:55.653974	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49755	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249727802024318 11/30/22-00:55:03.486766	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49727	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249713802025381 11/30/22-00:54:37.979213	TCP	2025381	ET TROJAN LokiBot Checkin	49713	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249756802021641 11/30/22-00:55:57.533680	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49756	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.865459532014169 11/30/22-00:55:47.178193	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	65459	53	192.168.2.3	8.8.8.8
95.213.216.202192.168.2.380497072025483 11/30/22-00:54:26.372322	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49707	95.213.216.202	192.168.2.3
192.168.2.395.213.216.20249715802021641 11/30/22-00:54:42.060768	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49715	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249712802825766 11/30/22-00:54:35.972913	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49712	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249753802825766 11/30/22-00:55:51.242717	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49753	80	192.168.2.3	95.213.216.202
192.168.2.38.8.8.854153532014169 11/30/22-00:55:51.152832	UDP	2014169	ET DNS Query for .su TLD (Soviet Union) Often Malware Related	54153	53	192.168.2.3	8.8.8.8
192.168.2.395.213.216.20249754802025381 11/30/22-00:55:53.496270	TCP	2025381	ET TROJAN LokiBot Checkin	49754	80	192.168.2.3	95.213.216.202
192.168.2.395.213.216.20249727802024313 11/30/22-00:55:03.486766	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49727	80	192.168.2.3	95.213.216.202

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 00:54:07.252681971 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:07.317872047 CET	80	49699	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:07.318666935 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:07.324934006 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:07.390002012 CET	80	49699	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:07.390280008 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:07.454189062 CET	80	49699	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:08.932713032 CET	80	49699	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:08.932929993 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:08.932929993 CET	49699	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:08.997078896 CET	80	49699	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:09.427567959 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:09.484437943 CET	80	49700	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:09.484872103 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:09.487690926 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:09.545456886 CET	80	49700	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:09.545732975 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:09.602526903 CET	80	49700	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:11.058943987 CET	80	49700	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:11.059271097 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:11.251259089 CET	49700	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:11.308391094 CET	80	49700	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:12.515145063 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:12.578533888 CET	80	49701	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:12.578650951 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:12.581435919 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:12.644690037 CET	80	49701	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:12.644942999 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:12.708281040 CET	80	49701	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:14.085145950 CET	80	49701	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:14.085324049 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:14.085324049 CET	49701	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:14.148653984 CET	80	49701	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:14.796390057 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:14.863887072 CET	80	49702	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:14.864324093 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:14.871390104 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:14.938833952 CET	80	49702	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:14.939245939 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:15.006510973 CET	80	49702	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:16.469088078 CET	80	49702	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:16.469213009 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:16.469305038 CET	49702	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:16.536587954 CET	80	49702	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:16.901004076 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:16.957978010 CET	80	49703	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:16.958115101 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:16.960834026 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:17.017646074 CET	80	49703	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:17.017842054 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:17.074562073 CET	80	49703	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:18.541620016 CET	80	49703	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:18.541914940 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:18.541914940 CET	49703	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:18.598728895 CET	80	49703	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:18.898685932 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:18.963310003 CET	80	49704	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:18.963515997 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:18.966131926 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:19.030903101 CET	80	49704	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:19.031228065 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:19.095748901 CET	80	49704	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:19.714504957 CET	80	49704	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:19.714649916 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:19.722553015 CET	49704	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:19.787149906 CET	80	49704	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:20.097837925 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:20.161624908 CET	80	49705	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:20.161886930 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:20.168790102 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:20.232583046 CET	80	49705	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:20.232693911 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:20.296284914 CET	80	49705	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:21.783216000 CET	80	49705	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:21.783595085 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:21.783595085 CET	49705	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:21.847395897 CET	80	49705	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:22.417725086 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:22.481591940 CET	80	49706	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:22.481817961 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:22.484255075 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:22.547919989 CET	80	49706	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:22.548185110 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:22.611813068 CET	80	49706	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:24.053488970 CET	80	49706	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:24.053700924 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.053700924 CET	49706	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.117465019 CET	80	49706	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:24.644469023 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.708810091 CET	80	49707	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:24.709328890 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.716723919 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.780909061 CET	80	49707	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:24.781121969 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:24.845062971 CET	80	49707	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:26.372322083 CET	80	49707	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:26.372553110 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:26.372901917 CET	49707	80	192.168.2.3	95.213.216.202
Nov 30, 2022 00:54:26.436924934 CET	80	49707	95.213.216.202	192.168.2.3
Nov 30, 2022 00:54:26.735404968 CET	49708	80	192.168.2.3	95.213.216.202

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 00:54:06.875981092 CET	49977	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:07.240958929 CET	53	49977	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:09.401173115 CET	57840	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:09.420834064 CET	53	57840	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:11.706173897 CET	57990	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:12.468837023 CET	53	57990	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:14.412322998 CET	52387	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:14.780765057 CET	53	52387	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:16.879287004 CET	56924	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:16.898757935 CET	53	56924	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:18.863516092 CET	60625	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:18.881309032 CET	53	60625	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:20.078244925 CET	49302	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:20.096685886 CET	53	49302	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:22.160619020 CET	53975	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:22.415709972 CET	53	53975	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:24.370686054 CET	51139	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:24.639362097 CET	53	51139	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:26.705693960 CET	52955	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:26.723373890 CET	53	52955	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:28.778636932 CET	60582	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:29.064884901 CET	53	60582	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:31.820801973 CET	57134	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:31.840390921 CET	53	57134	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:33.763792038 CET	62050	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:33.781332970 CET	53	62050	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:35.894645929 CET	56042	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:35.912352085 CET	53	56042	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:37.879678965 CET	59636	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:37.897547007 CET	53	59636	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:39.891168118 CET	55638	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:39.908864975 CET	53	55638	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:41.979608059 CET	57704	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:41.997195005 CET	53	57704	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:43.751688957 CET	65320	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:43.768886089 CET	53	65320	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:45.460011959 CET	60767	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:45.479480982 CET	53	60767	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:47.470066071 CET	65107	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:47.487802982 CET	53	65107	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:49.539402962 CET	53848	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:49.559163094 CET	53	53848	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:51.528645039 CET	57571	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:51.546144009 CET	53	57571	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:53.455722094 CET	58691	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:53.473742008 CET	53	58691	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:54.648302078 CET	53305	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:54.668741941 CET	53	53305	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:56.376061916 CET	59433	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:56.395571947 CET	53	59433	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:58.103972912 CET	60749	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:58.123743057 CET	53	60749	8.8.8.8	192.168.2.3
Nov 30, 2022 00:54:59.841953039 CET	56949	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:54:59.861439943 CET	53	56949	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:01.596754074 CET	52547	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:01.613591909 CET	53	52547	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:03.396282911 CET	53844	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:03.413459063 CET	53	53844	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:05.186135054 CET	65017	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:05.205918074 CET	53	65017	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:06.970989943 CET	53466	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:06.988650084 CET	53	53466	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:08.735474110 CET	57743	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:08.753017902 CET	53	57743	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:10.547934055 CET	53623	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:10.565411091 CET	53	53623	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:12.379224062 CET	61416	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:12.396709919 CET	53	61416	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:14.166464090 CET	65196	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:14.183665037 CET	53	65196	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:15.985743046 CET	58708	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:16.003206015 CET	53	58708	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:17.784200907 CET	59581	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:17.801747084 CET	53	59581	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:19.563471079 CET	53049	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:19.582814932 CET	53	53049	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:21.529314041 CET	60088	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:21.547068119 CET	53	60088	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:23.368357897 CET	63562	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:23.385291100 CET	53	63562	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:25.189213991 CET	53428	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:25.206536055 CET	53	53428	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:27.103034019 CET	65511	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:27.120949030 CET	53	65511	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:29.162121058 CET	59820	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:29.179055929 CET	53	59820	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:31.020256042 CET	64595	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:31.039771080 CET	53	64595	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:32.870194912 CET	52079	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:32.889683008 CET	53	52079	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:34.318233967 CET	64823	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:34.335309029 CET	53	64823	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:36.286011934 CET	51992	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:36.303749084 CET	53	51992	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:38.197046041 CET	58119	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:38.214360952 CET	53	58119	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:40.126117945 CET	49166	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:40.145720959 CET	53	49166	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:42.001540899 CET	58301	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:42.019203901 CET	53	58301	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:43.898413897 CET	63446	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:43.915456057 CET	53	63446	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:45.675020933 CET	49874	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:45.694405079 CET	53	49874	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:47.178193092 CET	65459	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:47.198072910 CET	53	65459	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:49.289719105 CET	65385	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:49.307233095 CET	53	65385	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:51.152832031 CET	54153	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:51.172306061 CET	53	54153	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:53.393349886 CET	64602	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:53.412369013 CET	53	64602	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:55.557055950 CET	50784	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:55.574852943 CET	53	50784	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:57.444180012 CET	64121	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:57.463988066 CET	53	64121	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:58.869049072 CET	64967	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:58.886452913 CET	53	64967	8.8.8.8	192.168.2.3
Nov 30, 2022 00:55:59.940840960 CET	60825	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:55:59.957931995 CET	53	60825	8.8.8.8	192.168.2.3
Nov 30, 2022 00:56:00.958663940 CET	49201	53	192.168.2.3	8.8.8.8
Nov 30, 2022 00:56:00.977658987 CET	53	49201	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2022 00:54:06.875981092 CET	192.168.2.3	8.8.8.8	0x6188	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:09.401173115 CET	192.168.2.3	8.8.8.8	0x5d3b	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:11.706173897 CET	192.168.2.3	8.8.8.8	0xb7e8	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:14.412322998 CET	192.168.2.3	8.8.8.8	0x4082	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:16.879287004 CET	192.168.2.3	8.8.8.8	0x22b9	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:18.863516092 CET	192.168.2.3	8.8.8.8	0xeaac	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:20.078244925 CET	192.168.2.3	8.8.8.8	0x28fb	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:22.160619020 CET	192.168.2.3	8.8.8.8	0xee98	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:24.370686054 CET	192.168.2.3	8.8.8.8	0x2624	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:26.705693960 CET	192.168.2.3	8.8.8.8	0x5477	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:28.778636932 CET	192.168.2.3	8.8.8.8	0xdecc	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:31.820801973 CET	192.168.2.3	8.8.8.8	0x1c2d	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:33.763792038 CET	192.168.2.3	8.8.8.8	0xf2e6	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:35.894645929 CET	192.168.2.3	8.8.8.8	0x1fc5	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:37.879678965 CET	192.168.2.3	8.8.8.8	0xbad	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:39.891168118 CET	192.168.2.3	8.8.8.8	0x785c	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:41.979608059 CET	192.168.2.3	8.8.8.8	0xabaf	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:43.751688957 CET	192.168.2.3	8.8.8.8	0x692b	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:45.460011959 CET	192.168.2.3	8.8.8.8	0x4377	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:47.470066071 CET	192.168.2.3	8.8.8.8	0xbe7a	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:49.539402962 CET	192.168.2.3	8.8.8.8	0x9c9a	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:51.528645039 CET	192.168.2.3	8.8.8.8	0xb58	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:53.455722094 CET	192.168.2.3	8.8.8.8	0xdac7	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:54.648302078 CET	192.168.2.3	8.8.8.8	0xaacd	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:56.376061916 CET	192.168.2.3	8.8.8.8	0x479c	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:58.103972912 CET	192.168.2.3	8.8.8.8	0xea9f	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:59.841953039 CET	192.168.2.3	8.8.8.8	0x16e7	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:01.596754074 CET	192.168.2.3	8.8.8.8	0x35c4	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:03.396282911 CET	192.168.2.3	8.8.8.8	0x8db7	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:05.186135054 CET	192.168.2.3	8.8.8.8	0xa497	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:06.970989943 CET	192.168.2.3	8.8.8.8	0x67db	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:08.735474110 CET	192.168.2.3	8.8.8.8	0x7db5	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:10.547934055 CET	192.168.2.3	8.8.8.8	0x1fa1	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:12.379224062 CET	192.168.2.3	8.8.8.8	0x4f02	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:14.166464090 CET	192.168.2.3	8.8.8.8	0x4ab6	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:15.985743046 CET	192.168.2.3	8.8.8.8	0x3921	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:17.784200907 CET	192.168.2.3	8.8.8.8	0xc7dc	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:19.563471079 CET	192.168.2.3	8.8.8.8	0x46b9	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:21.529314041 CET	192.168.2.3	8.8.8.8	0x213	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:23.368357897 CET	192.168.2.3	8.8.8.8	0x1d07	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:25.189213991 CET	192.168.2.3	8.8.8.8	0x6e37	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:27.103034019 CET	192.168.2.3	8.8.8.8	0xea01	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:29.162121058 CET	192.168.2.3	8.8.8.8	0x4235	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:31.020256042 CET	192.168.2.3	8.8.8.8	0xa106	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:32.870194912 CET	192.168.2.3	8.8.8.8	0x86ee	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:34.318233967 CET	192.168.2.3	8.8.8.8	0x2d83	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:36.286011934 CET	192.168.2.3	8.8.8.8	0xbdf8	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:38.197046041 CET	192.168.2.3	8.8.8.8	0x23f4	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:40.126117945 CET	192.168.2.3	8.8.8.8	0x856e	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:42.001540899 CET	192.168.2.3	8.8.8.8	0x3a49	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:43.898413897 CET	192.168.2.3	8.8.8.8	0x4c7e	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:45.675020933 CET	192.168.2.3	8.8.8.8	0xd354	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:47.178193092 CET	192.168.2.3	8.8.8.8	0x8af6	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:49.289719105 CET	192.168.2.3	8.8.8.8	0xc369	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:51.152832031 CET	192.168.2.3	8.8.8.8	0xe950	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:53.393349886 CET	192.168.2.3	8.8.8.8	0x9913	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:55.557055950 CET	192.168.2.3	8.8.8.8	0x2074	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:57.444180012 CET	192.168.2.3	8.8.8.8	0x2543	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:58.869049072 CET	192.168.2.3	8.8.8.8	0x92c3	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:59.940840960 CET	192.168.2.3	8.8.8.8	0x3488	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:56:00.958663940 CET	192.168.2.3	8.8.8.8	0x58c4	Standard query (0)	sempersim.su	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 30, 2022 00:54:07.240958929 CET	8.8.8.8	192.168.2.3	0x6188	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:09.420834064 CET	8.8.8.8	192.168.2.3	0x5d3b	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:12.468837023 CET	8.8.8.8	192.168.2.3	0xb7e8	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:14.780765057 CET	8.8.8.8	192.168.2.3	0x4082	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:16.898757935 CET	8.8.8.8	192.168.2.3	0x22b9	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:18.881309032 CET	8.8.8.8	192.168.2.3	0xeaac	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:20.096685886 CET	8.8.8.8	192.168.2.3	0x28fb	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:22.415709972 CET	8.8.8.8	192.168.2.3	0xee98	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:24.639362097 CET	8.8.8.8	192.168.2.3	0x2624	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:26.723373890 CET	8.8.8.8	192.168.2.3	0x5477	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:29.064884901 CET	8.8.8.8	192.168.2.3	0xdecc	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:31.840390921 CET	8.8.8.8	192.168.2.3	0x1c2d	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:33.781332970 CET	8.8.8.8	192.168.2.3	0xf2e6	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:35.912352085 CET	8.8.8.8	192.168.2.3	0x1fc5	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:37.897547007 CET	8.8.8.8	192.168.2.3	0xbad	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:39.908864975 CET	8.8.8.8	192.168.2.3	0x785c	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:41.997195005 CET	8.8.8.8	192.168.2.3	0xabaf	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:43.768886089 CET	8.8.8.8	192.168.2.3	0x692b	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:45.479480982 CET	8.8.8.8	192.168.2.3	0x4377	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:47.487802982 CET	8.8.8.8	192.168.2.3	0xbe7a	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:49.559163094 CET	8.8.8.8	192.168.2.3	0x9c9a	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:51.546144009 CET	8.8.8.8	192.168.2.3	0xb58	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:53.473742008 CET	8.8.8.8	192.168.2.3	0xdac7	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:54.668741941 CET	8.8.8.8	192.168.2.3	0xaacd	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:56.395571947 CET	8.8.8.8	192.168.2.3	0x479c	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:58.123743057 CET	8.8.8.8	192.168.2.3	0xea9f	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:54:59.861439943 CET	8.8.8.8	192.168.2.3	0x16e7	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:01.613591909 CET	8.8.8.8	192.168.2.3	0x35c4	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:03.413459063 CET	8.8.8.8	192.168.2.3	0x8db7	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:05.205918074 CET	8.8.8.8	192.168.2.3	0xa497	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:06.988650084 CET	8.8.8.8	192.168.2.3	0x67db	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:08.753017902 CET	8.8.8.8	192.168.2.3	0x7db5	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:10.565411091 CET	8.8.8.8	192.168.2.3	0x1fa1	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:12.396709919 CET	8.8.8.8	192.168.2.3	0x4f02	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:14.183665037 CET	8.8.8.8	192.168.2.3	0x4ab6	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:16.003206015 CET	8.8.8.8	192.168.2.3	0x3921	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:17.801747084 CET	8.8.8.8	192.168.2.3	0xc7dc	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:19.582814932 CET	8.8.8.8	192.168.2.3	0x46b9	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:21.547068119 CET	8.8.8.8	192.168.2.3	0x213	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:23.385291100 CET	8.8.8.8	192.168.2.3	0x1d07	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:25.206536055 CET	8.8.8.8	192.168.2.3	0x6e37	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:27.120949030 CET	8.8.8.8	192.168.2.3	0xea01	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:29.179055929 CET	8.8.8.8	192.168.2.3	0x4235	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:31.039771080 CET	8.8.8.8	192.168.2.3	0xa106	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:32.889683008 CET	8.8.8.8	192.168.2.3	0x86ee	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:34.335309029 CET	8.8.8.8	192.168.2.3	0x2d83	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:36.303749084 CET	8.8.8.8	192.168.2.3	0xbdf8	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:38.214360952 CET	8.8.8.8	192.168.2.3	0x23f4	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:40.145720959 CET	8.8.8.8	192.168.2.3	0x856e	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:42.019203901 CET	8.8.8.8	192.168.2.3	0x3a49	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:43.915456057 CET	8.8.8.8	192.168.2.3	0x4c7e	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:45.694405079 CET	8.8.8.8	192.168.2.3	0xd354	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:47.198072910 CET	8.8.8.8	192.168.2.3	0x8af6	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:49.307233095 CET	8.8.8.8	192.168.2.3	0xc369	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:51.172306061 CET	8.8.8.8	192.168.2.3	0xe950	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:53.412369013 CET	8.8.8.8	192.168.2.3	0x9913	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:55.574852943 CET	8.8.8.8	192.168.2.3	0x2074	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:57.463988066 CET	8.8.8.8	192.168.2.3	0x2543	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:58.886452913 CET	8.8.8.8	192.168.2.3	0x92c3	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:55:59.957931995 CET	8.8.8.8	192.168.2.3	0x3488	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:56:00.977658987 CET	8.8.8.8	192.168.2.3	0x58c4	No error (0)	sempersim.su	95.213.216.202	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

sempersim.su

Target ID:	0
Start time:	00:53:56
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Imagebase:	0x3d0000
File size:	865280 bytes
MD5 hash:	BAED30AEA51E6000571219633AA745B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.262961989.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.259415034.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.259503560.0000000002C1F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.262806149.0000000003F48000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: INV.2022LB0362 FORM CO (2).exePID: 2240, Parent PID: 6092

General

Target ID:	1
Start time:	00:54:03
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Imagebase:	0x1d0000
File size:	865280 bytes
MD5 hash:	BAED30AEA51E6000571219633AA745B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: INV.2022LB0362 FORM CO (2).exePID: 5164, Parent PID: 6092

General

Target ID:	2
Start time:	00:54:03
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Imagebase:	0x360000
File size:	865280 bytes
MD5 hash:	BAED30AEA51E6000571219633AA745B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: INV.2022LB0362 FORM CO (2).exePID: 6132, Parent PID: 6092

General

Target ID:	3
Start time:	00:54:03
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\INV.2022LB0362 FORM CO (2).exe
Imagebase:	0xc70000
File size:	865280 bytes
MD5 hash:	BAED30AEA51E6000571219633AA745B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000003.00000000.255109806.0000000000415000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000003.00000002.506514782.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000003.00000000.255040267.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report INV.2022LB0362 FORM CO (2).exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Lokibot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\INV.2022LB0362 FORM CO (2).exe.log

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
INV.2022LB0362 FORM CO (2).exe