Edit tour

Windows Analysis Report
U6ghPv3E7k.exe

Overview

General Information

Sample name:	U6ghPv3E7k.exe renamed because original name is a hash value
Original sample name:	3c9bc8ec388807318127107c760233483bbba43a9c186eb7ed794d8fe4ffeb44.exe
Analysis ID:	1546123
MD5:	00ba1e1d154e18d1124d87934fae9f20
SHA1:	41bfc98b2b24f4f70852f2de62c08e3c2aaf85ad
SHA256:	3c9bc8ec388807318127107c760233483bbba43a9c186eb7ed794d8fe4ffeb44
Tags:	exevacationtogotravels-netuser-JAMESWT_MHT
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

U6ghPv3E7k.exe (PID: 5640 cmdline: "C:\Users\user\Desktop\U6ghPv3E7k.exe" MD5: 00BA1E1D154E18D1124D87934FAE9F20)

conhost.exe (PID: 5892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

iexplore.exe (PID: 5532 cmdline: "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding MD5: CFE2E6942AC1B72981B3105E22D3224E)

iexplore.exe (PID: 3688 cmdline: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5532 CREDAT:17410 /prefetch:2 MD5: 6F0F06D6AB125A99E43335427066A4A1)

ssvagent.exe (PID: 6152 cmdline: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new MD5: F9A898A606E7F5A1CD7CFFA8079253A0)

cleanup

Sigma Signatures

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, CommandLine|base64offset|contains: w, Image: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, NewProcessName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, OriginalFileName: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe, ParentCommandLine: "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5532 CREDAT:17410 /prefetch:2, ParentImage: C:\Program Files (x86)\Internet Explorer\iexplore.exe, ParentProcessId: 3688, ParentProcessName: iexplore.exe, ProcessCommandLine: "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new, ProcessId: 6152, ProcessName: ssvagent.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Program Files\Internet Explorer\iexplore.exe, ProcessId: 5532, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T14:32:37.044546+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.5	49708	TCP
2024-10-31T14:33:15.592916+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.5	49931	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50020 version: TLS 1.2

Source: U6ghPv3E7k.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View

JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.5:49708
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.5:49931

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: vacationtogotravels.netConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: vacationtogotravels.net

Source: unknown

HTTP traffic detected: POST /register HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-CHUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: vacationtogotravels.netContent-Length: 8Connection: Keep-AliveCache-Control: no-cache

Source: U6ghPv3E7k.exe, 00000000.00000003.2203274887.000002D47C23E000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2194792115.000002D47C23E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vacationtogotravels.net/register
Source: U6ghPv3E7k.exe, 00000000.00000003.2257822965.000002D47C2C6000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2218327326.000002D47C24F000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2254497955.000002D47C2C6000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2251266127.000002D47C24B000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2254920750.000002D47C2C6000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2248276830.000002D47C2D3000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2256754273.000002D47C2C6000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2245514478.000002D47C290000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2257911553.000002D47C2CD000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2215564565.000002D47C24D000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2219233771.000002D47C24B000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2246626009.000002D47C2D1000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2245701697.000002D47C24B000.00000004.00000020.00020000.00000000.sdmp, U6ghPv3E7k.exe, 00000000.00000003.2251266127.000002D47C2C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vacationtogotravels.net/upload

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50002 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.221.225.227:443 -> 192.168.2.5:50020 version: TLS 1.2

Source: classification engine

Classification label: clean3.winEXE@7/28@1/1

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5892:120:WilError_03

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF4C4ABBEFBEE1C868.TMP

Jump to behavior

Source: U6ghPv3E7k.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Internet Explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\U6ghPv3E7k.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\U6ghPv3E7k.exe "C:\Users\user\Desktop\U6ghPv3E7k.exe"
Source: C:\Users\user\Desktop\U6ghPv3E7k.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5532 CREDAT:17410 /prefetch:2
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5532 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe "C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new	Jump to behavior

Source: C:\Users\user\Desktop\U6ghPv3E7k.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\U6ghPv3E7k.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\U6ghPv3E7k.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\U6ghPv3E7k.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\U6ghPv3E7k.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\U6ghPv3E7k.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\U6ghPv3E7k.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: U6ghPv3E7k.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: U6ghPv3E7k.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: U6ghPv3E7k.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: U6ghPv3E7k.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: U6ghPv3E7k.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: U6ghPv3E7k.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: U6ghPv3E7k.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: U6ghPv3E7k.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: U6ghPv3E7k.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: U6ghPv3E7k.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: U6ghPv3E7k.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: U6ghPv3E7k.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: U6ghPv3E7k.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: U6ghPv3E7k.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: U6ghPv3E7k.exe	Static PE information: section name: .msvcjmc
Source: U6ghPv3E7k.exe	Static PE information: section name: _RDATA

Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\Desktop\U6ghPv3E7k.exe TID: 3140

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\U6ghPv3E7k.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
U6ghPv3E7k.exe	3%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vacationtogotravels.net	89.221.225.227	true	false		unknown

Contacted URLs

Name	Malicious	Reputation
https://vacationtogotravels.net/upload	false	unknown
https://vacationtogotravels.net/favicon.ico	false	unknown
https://vacationtogotravels.net/register	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.221.225.227	vacationtogotravels.net	Russian Federation		41691	SUMTEL-AS-RIPEMoscowRussiaRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546123
Start date and time:	2024-10-31 14:31:28 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	U6ghPv3E7k.exe renamed because original name is a hash value
Original Sample Name:	3c9bc8ec388807318127107c760233483bbba43a9c186eb7ed794d8fe4ffeb44.exe
Detection:	CLEAN
Classification:	clean3.winEXE@7/28@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, ielowutil.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.89.167, 2.23.209.143, 2.23.209.133, 2.23.209.149, 2.23.209.135, 2.23.209.140, 2.23.209.154, 2.23.209.193, 2.23.209.132, 2.23.209.130, 204.79.197.200
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, www-www.bing.com.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e11290.dspg.akamaiedge.net, go.microsoft.com, e86303.dscx.akamaiedge.net, any.edge.bing.com, ocsp.digicert.com, www.bing.com.edgekey.net, go.microsoft.com.edgekey.net, ieonline.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtSetValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: U6ghPv3E7k.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
89.221.225.227	RafaelConnect.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vacationtogotravels.net	RafaelConnect.exe	Get hash	malicious	Unknown	Browse	89.221.225.227

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SUMTEL-AS-RIPEMoscowRussiaRU	RafaelConnect.exe	Get hash	malicious	Unknown	Browse	89.221.225.227
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.172.94.66
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	109.172.94.66
	sh4.elf	Get hash	malicious	Unknown	Browse	87.117.138.145
	yakuza.i686.elf	Get hash	malicious	Unknown	Browse	178.130.55.72
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	109.172.60.44
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	109.172.88.38
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	109.172.88.38
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	89.221.206.246
	wa_3rd_party_host_32.exe	Get hash	malicious	GO Backdoor	Browse	109.172.88.38

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	RafaelConnect.exe	Get hash	malicious	Unknown	Browse	89.221.225.227
	https://saniest.com/PO/PO%20-%20OCT.'24673937.rar	Get hash	malicious	Unknown	Browse	89.221.225.227
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	89.221.225.227
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	89.221.225.227
	http://wesiakkaernten.fibery.io/@public/forms/gBNXdAWE	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	89.221.225.227
	PO-004976.xls	Get hash	malicious	Unknown	Browse	89.221.225.227
	NUEVA ORDEN DE COMPRA 73244.xla.xlsx	Get hash	malicious	Unknown	Browse	89.221.225.227
	-Payout Salary Benefits.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	89.221.225.227
	https://forthedoglover.com/Ray-verify.html	Get hash	malicious	Unknown	Browse	89.221.225.227
	FW Complete with Docusign Remittance Advice .pdf.eml	Get hash	malicious	Unknown	Browse	89.221.225.227

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{92095A5E-978C-11EF-8C2C-ECF4BB570DC9}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	2.0485581541969253
Encrypted:	false
SSDEEP:	12:rl0YmGF8rEgm2p+IaCyh0I/GgSFPrEgmw+IaCr8Ohh0I/G9bVJI0G77w0IusG77g:rOGW/O6Go/QKwCKE9lW8Iy9lW8c
MD5:	9F1DA61630EC01E7FDC817584C1DBF99
SHA1:	9364FC560BA1598403EB0D8E84A989CDAF245EB6
SHA-256:	A692C428B86E9141C8E062F86D9ADD935C9E633B45079DF19F29C246C7AC55F6
SHA-512:	089416F8AE8B68FFC160720E77861D95CAE149B8E13AB9BF047156BCBAD78FF8A457E320507005AC9E71F18D8D17D67AEA543780B99D91A324764951CAFCDDB2
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y......................................................................................... ..U.+................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0.......O._.T.S.X.1.o.J.k.o.y.X.7.x.G.M.L.O.z.0.u.1.c.N.y.Q.=.=.........:.......................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{92095A60-978C-11EF-8C2C-ECF4BB570DC9}.dat

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	747520
Entropy (8bit):	7.903732021467866
Encrypted:	false
SSDEEP:	12288:yOC8WXXlS1cA9D2R9W0pUmaYeZhPgI7BSJW6A9sXvdQhjqwUpsT4SJFKOJzKDh/K:FJ+XlxkUpAYeRSU6AsfdQhjqwUpsT46N
MD5:	621E21F741ABE063787760044CD6B850
SHA1:	8F0D2D02DB56EFD21268FD5A6F0ECB94A54B1DD6
SHA-256:	2AD3DEF377866EC09DF1D37BEEBB735235FD9744FA1E8259F63A8AB77AEA2E93
SHA-512:	4F51C18ACA46D6AE5B1D822B6325E5C5652C84127CF7886DD1351828DBFDB9D2E70ACD90715B01613F809B41653D06E4B3CA41916A84D5762F3C88D7CB96643C
Malicious:	false
Reputation:	low
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y..............................................................................................+......@y........K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8... ...................................................(.......T.r.a.v.e.l.L.o.g...............................................................................................................T.L.0...................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (314), with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.126293620670883
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc41Ef0+oATD90/QL3WIZK0QhPPFVDHkEtMjwu:TMHdNMNxOEf3FnWimI00ONVbkEtMb
MD5:	71017C977EE6F6AA87974E58A49D192F
SHA1:	69C1D96C34B357D6DA40681A6EECD4CBC9CC2548
SHA-256:	0E964D8A703A4F3D7CF56D9FB896DB783F4B44658FF79F30898672CF9A5D65BF
SHA-512:	37AA0FBBC513A9FF8DB1E4DAB06903F65C81685710681BBA0732C5FF78CA95778D1502EF26AC62968A5A11D49C44A583DF8D0306CE95C96048BCC2850D9C4400
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x5a279f41,0x01db2b99</date><accdate>0x5a2a01d5,0x01db2b99</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.133086096247183
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4fLGTk8oby5GATD90/QL3WIZK0QhPPFkI5kU5EtMjwu:TMHdNMNxe2kvyFnWimI00ONkak6EtMb
MD5:	8A7269D0C714A8995AE6272CB69CFDD8
SHA1:	2032DC4FF09F425CB6688F472E79899CBF21E882
SHA-256:	8EBB405F14B5D2A7D83B12A0E5F42D77D4BC3FDDA4C32CD6CF5D277BB0E0681F
SHA-512:	61F33BB99A1FF43098106046EEBB4EDCEB1B2AF1D124A63A591C17F9640D0F134362820247342421B5A53F1532C916B19AFEE4C45B2FB0ABB44057FD9C500361
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x5a16eeda,0x01db2b99</date><accdate>0x5a1951e0,0x01db2b99</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (318), with CRLF line terminators
Category:	dropped
Size (bytes):	360
Entropy (8bit):	5.147326648465847
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4GLloToATD90/QL3WIZK0QhPPFyhBcEEtMjwu:TMHdNMNxvLlCFnWimI00ONmZEtMb
MD5:	570697D96EEBCEFB125977328C2347CE
SHA1:	DF0CFDB3A58B437FA07DEA943A4539E6B194D8E9
SHA-256:	A5C25E48EA7092F1A155200203E7FF8919D3302038C2F9A1F7CD2E5C13A24DB6
SHA-512:	95D30EDFFD0D19EB0DCF03C894C4165EC763CC75326915F044DE016D83B9F293E41BCD7309CA59A8477272C4ABA13280821F4F8FC22FF254D83E404A8D1478A5
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x5a2a01d5,0x01db2b99</date><accdate>0x5a2c6401,0x01db2b99</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (335), with CRLF line terminators
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.174777793671675
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltq08eDPOOKaihM5y5Gby5GATD90/QL3WIZK0QhPPFcE5EtMjwu:TMHdNMNxtDPOOKaJy2yFnWimI00ONcE/
MD5:	20F4D6A474391AFEC506A9BDBD04ADAB
SHA1:	F1CE944B299C6E38B6566DAB0F108BF66DDB9308
SHA-256:	9D02E27C78B38F51C719F78160BAD04941AC9C60B2A55B6D3720C675D7F985A0
SHA-512:	8F4BD4525C2D4FE639CF600FF8981C3348B501DC50B21BC76FA02D297AE2C24B7EA0C9AB564230472C44CBD2845A47A4464F2CCCED098924270595F0C8F2BEB8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://go.microsoft.com/fwlink/p/?LinkId=255142"/><date>0x5a1951e0,0x01db2b99</date><accdate>0x5a1951e0,0x01db2b99</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Bing.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.146690459870908
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4JIo2BATD90/QL3WIZK0QhPPFgE5EtMjwu:TMHdNMNxiIunWimI00ONd5EtMb
MD5:	2C4E530408D6DF0BB3025745CDE1CADB
SHA1:	46537378CA1A32C025A948BB262717DF140BC928
SHA-256:	0FB2A20C31578E3B1231555A5495594FC60A836C110B5EE9EA3A6FCD4A13AB2F
SHA-512:	6B75F2981B89701F09CD6F4EDF9F0CFFA32EACB5E705A9A183757871DC6773C5907954F2405729B32D3F5BF9791633EBCCD3D3FDF7731FACFEF41DF8A163ABEE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x5a1e15d1,0x01db2b99</date><accdate>0x5a207862,0x01db2b99</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (314), with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1674728996276675
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4UxGw0oToATD90/QL3WIZK0QhPPF8K0QU5EtMjwu:TMHdNMNxhGw0CFnWimI00ON8K075EtMb
MD5:	D0785BD19D055C79E97487EBB043CE06
SHA1:	D83A5546BDBC1918688FD31E0A002EBB7B006021
SHA-256:	321BFF27B505F427E8C2EA2E86306F8528044478E18AD205FC8B267EF56E6995
SHA-512:	35D8E97D53C120A6A94BA70DF9F6ABA30806E1527F12D6216DE5D406B181FCDCE764B57DB0F0A54C48BDBB93E94D7BA513F7AA533CD489E6770C7CF5EE019BD5
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x5a2c6401,0x01db2b99</date><accdate>0x5a2c6401,0x01db2b99</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.137169723773084
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4QunDT5U0ATD90/QL3WIZK0QhPPFAkEtMjwu:TMHdNMNx0nDuRnWimI00ONxEtMb
MD5:	BAB1293460FDF40457ABBB01934AEC21
SHA1:	F7868B8C8CEEBEC8CCEF2BF56F7DA47917239602
SHA-256:	3966B1C34E7BB2BCC36778D18391DF97531777F8E18B132B84840B9091292A8C
SHA-512:	5B2C94E8999E3C00527C06C0AE8474263D93ABB7924018AC73D37990134AC6D1C89BAF271D82D12FFD6BACD76C992798F54495203CA7B9A5432460F2E585AA84
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x5a253ce2,0x01db2b99</date><accdate>0x5a279f41,0x01db2b99</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (314), with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.161598546097512
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4oTWbokT5ATD90/QL3WIZK0QhPPF6Kq5EtMjwu:TMHdNMNxxWVunWimI00ON6Kq5EtMb
MD5:	A6CE0D7510BF303E3698CABC1DB75116
SHA1:	A1D7F093A7678168F89701BFB695997E2E64FA35
SHA-256:	0AA75BF5FB5F4A1A60994E52FD5F507B28B295BD250FDE5F2A091E21AAC853FE
SHA-512:	F5C3B0E6E4B331D1DE739E445B27948CC930F2B93765A26D13908648B9894E53EB2F57BB8F05A45123C3208737FF8458251B37BC9F90029BBC35675A1BB836C5
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x5a22dab1,0x01db2b99</date><accdate>0x5a253ce2,0x01db2b99</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (316), with CRLF line terminators
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.110780442228553
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4YX2nUy5Gis0ATD90/QL3WIZK0QhPPF02CqEtMjwu:TMHdNMNxcUy1InWimI00ONVEtMb
MD5:	76FD1CFE8C51AE87548E8C178B7DB093
SHA1:	4CA88E3DE91E41E5464E40B0A2EBD32902E39274
SHA-256:	702AEE8D62B4C3419078E048BEC4CE629A2867BD518D9618FB6BACCC66CF29F8
SHA-512:	5B55E0ABEB463BB1CB72562EF3A8450FF429956499BF590D61E691F8CE4BF6BFC020DF62F509183AED1C26196B0744E046E9BC5EFDF50302A45E48FC90067C7E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5a1951e0,0x01db2b99</date><accdate>0x5a1bb3a1,0x01db2b99</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.099119218107469
Encrypted:	false
SSDEEP:	6:TMVBdc9EMdLD5Ltqc4In/s0Ho2ATD90/QL3WIZK0QhPPFiwE5EtMjwu:TMHdNMNxfn/P0nWimI00ONe5EtMb
MD5:	483C2A1DBC4A8597903B239F11EB0FC9
SHA1:	C8C3DE08C11D64490AC91ED56E435891FDD99264
SHA-256:	43B137B871C7356658E3C178AA5016E944543FAF7038FD1C15AB9744D00624EF
SHA-512:	7D70F5764FFB90187EBD4B804D1B108BCF5916D629DB162FFA68ECFCA51ED981A8BA1199DE77D2F07A3BA2C102DD3481A8601960A61DE8C4927E5EC6BCC4C919
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x5a1bb3a1,0x01db2b99</date><accdate>0x5a1e15d1,0x01db2b99</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\m1niz3t\imagestore.dat

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	4.385669629869206
Encrypted:	false
SSDEEP:	24:w/k5OmKMM/1RKOMFMUbasvCYn+zR38zH7rp2BOb6w3A8djX:w/k5Omn61RKONyZTn+zRqPwBi3AU
MD5:	D0FA4A18E595FD157B6992AD09611524
SHA1:	C6ACC6DF94C2D0E77822E17993221BD2642FA261
SHA-256:	221CDE54892CBAA0C32DCAADBF259DAEF8AA8DBFCCBFE01C5188E5A42698E1C0
SHA-512:	9495AA9A51FCFCF6DD65C593AF0DA37BF816AF267A7653B1035E282062FF263C28B069139521AE7BCD7FABEC4B478AA07C2270C55D5BA43E1651A82E80438489
Malicious:	false
Preview:	........+.h.t.t.p.s.:././.v.a.c.a.t.i.o.n.t.o.g.o.t.r.a.v.e.l.s...n.e.t./.f.a.v.i.c.o.n...i.c.o.~............... .h.......(....... ..... .....................................................................................................................................................................................................................................................................................................Y..1..&...?..............b........................... ...L.,...3{....O...[...9...................................].....g......}..)p....................................................."...!z..!u..............................................;............k..q.......................................mmp.........[...J...e.......................................................................WVY.LKN.YX[.....................................................FFI.jjl.................................................}}............................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\uploadfcba94a8[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	1.8423709931771088
Encrypted:	false
SSDEEP:	3:BzW:B6
MD5:	260CA9DD8A4577FC00B7BD5810298076
SHA1:	53A5687CB26DC41F2AB4033E97E13ADEFD3740D6
SHA-256:	AEE408847D35E44E99430F0979C3357B85FE8DBB4535A494301198ADBEE85F27
SHA-512:	51E85DEB51C2B909A21EC5B8E83B1CB28DA258B1BE227620105A345A2BD4C6AEA549CD5429670F2DF33324667B9F623A420B3A0BDBBD03AD48602211E75478A7
Malicious:	false
Preview:	success

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\favicon[1].ico

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	3.8046022951415335
Encrypted:	false
SSDEEP:	24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
MD5:	DA597791BE3B6E732F0BC8B20E38EE62
SHA1:	1125C45D285C360542027D7554A5C442288974DE
SHA-256:	5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
SHA-512:	D8DC8358727590A1ED74DC70356AEDC0499552C2DC0CD4F7A01853DD85CEB3AEAD5FBDC7C75D7DA36DB6AF2448CE5ABDFF64CEBDCA3533ECAD953C061A9B338E
Malicious:	false
Preview:	...... .... .........(... ...@..... ...................................................................................................................................................................................................N...Sz..R...R...P...N..L..H..DG..........................................................................................R6..U...U...S...R...P...N..L..I..F..B...7...............................................................................S6..V...V...U...S...R...P...N..L..I..F..C...?..:z......................................................................O...W...V...V...U...S...R...P...N..L..I..E..C...?...;..{7..q2$..............................................................T..D..]...S)..p6..J...R...P...N..L..I..E..B..>..;..z7..p2..f,X.........................................................A..O#..N!..N!..N!..P$..q:...P...N..K..I..E..A..=..9..x5..n0..e,...5...................................................Ea.Z,..T$..T$..T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\registerbb130302[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.418295834054489
Encrypted:	false
SSDEEP:	3:qC00WZYn:qp0WZYn
MD5:	A6782B013EAA517B79847912A457194F
SHA1:	03DAC5027F2687ED65058E81118B5CA39DB16898
SHA-256:	48523A99BBC6DDF44FADC11BA8C207F5DEF41D52EF0C16227E39A4F319BA5ACB
SHA-512:	BC2B65EC2197C1A01E9BDD36461D6B394AB532CAA573AB3874725C1E32AAE8B62C4570F4992108E79CF3FC5FE87C9DC917BB9699BADFB0762446DEE6787BDDF8
Malicious:	false
Preview:	IMo3Gg8SV76mFZc3Jbx/1Q==

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\registerbb130302[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.251629167387823
Encrypted:	false
SSDEEP:	3:ilR8LQrzHFY:cR84i
MD5:	6458854FFFD64C6A727E52C3C26BCD56
SHA1:	0AD600F29D6A1BB493B4256FEED8A02679A8B9FE
SHA-256:	936BAD349C190AF1AD7354C044468AE48669473705FB3082E0AD31451861764A
SHA-512:	334EF2F7DF6D7A133F5AE2399F9FE88181CAA79A600925148F0DB8E76265D0703B9C7DB7F9BF07C24AD21B31EA3868666133FFAA9FD1279215CF7CCFBC0359FE
Malicious:	false
Preview:	/TBG5vzh5r7Y7HquNVLL0g==

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\favicon[1].ico

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.180335795345366
Encrypted:	false
SSDEEP:	24:XKMM/1RKOMFMUbasvCYn+zR38zH7rp2BOb6w3A8d:Xn61RKONyZTn+zRqPwBi3A
MD5:	DE1EFA7A85DF33A73C038049502E3750
SHA1:	A3C9D5B1E8DC51476A6193BB2B2C1899A835928A
SHA-256:	89A4C72D2A238E2D820845414607BD77457FE289896345D9C23540F62B2C7051
SHA-512:	04AFE246654055018E7F01683812F34EF384F0E5F1E28F6BC1D028D6EA35EC5B77A07E5103AF562965D8397D248BA006156AC0790F14F24B5733E2C686C018AF
Malicious:	false
Preview:	............ .h.......(....... ..... .....................................................................................................................................................................................................................................................................................................Y..1..&...?..............b........................... ...L.,...3{....O...[...9...................................].....g......}..)p....................................................."...!z..!u..............................................;............k..q.......................................mmp.........[...J...e.......................................................................WVY.LKN.YX[.....................................................FFI.jjl.................................................}}..........................................................]\_.JIL.POR.ddf._^a.............................................{z\|."!%.*)-.:9=.QPS...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\register[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	5.033184175406308
Encrypted:	false
SSDEEP:	3:7/YkttmNFjESjHH7HBY:7Nt462bu
MD5:	52005468EE51D684E8D726ECA3C07F4D
SHA1:	D8B11B8F88065A89388ECDE317519CA562E6FE49
SHA-256:	FC309DC28B9FA00BFB9FCB66FC0BA34D574D2BC278B294CC473044116EEC53F8
SHA-512:	F725D1D500A98D7BAD4408B5662405D30394B892B5A7A5C0A739B878F619E51810658266DFAC6C266488EA46D2845D29F248921F400B9506690570E1411053D7
Malicious:	false
Preview:	+1Z2m5QzOHnneu2SJpWFUFh35bqRIb/9oEkewHYvR24=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\registerbb130302[1].htm

Download File

Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	24
Entropy (8bit):	4.251629167387823
Encrypted:	false
SSDEEP:	3:ilR8LQrzHFY:cR84i
MD5:	6458854FFFD64C6A727E52C3C26BCD56
SHA1:	0AD600F29D6A1BB493B4256FEED8A02679A8B9FE
SHA-256:	936BAD349C190AF1AD7354C044468AE48669473705FB3082E0AD31451861764A
SHA-512:	334EF2F7DF6D7A133F5AE2399F9FE88181CAA79A600925148F0DB8E76265D0703B9C7DB7F9BF07C24AD21B31EA3868666133FFAA9FD1279215CF7CCFBC0359FE
Malicious:	false
Preview:	/TBG5vzh5r7Y7HquNVLL0g==

C:\Users\user\AppData\Local\Temp\~DF3233F130AB51BE21.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.13643452625205535
Encrypted:	false
SSDEEP:	6:a/vllXalyPSQl3+tsM92II+tKYXPqjH4GjicmFNtulDSf//hIHQlk7:i9lXatQ0tj2IIQ/kYZc5lDSf//MQ
MD5:	03BEDABAC699776F19B267D9108B4EBC
SHA1:	76C25D3A3FAA33C8630FC59EA3183B7F7FDF28C1
SHA-256:	B1F2F1F6A958662266780C7C3B00D2D1D50ED4D071F8CE5F0985D480C27B1F89
SHA-512:	DAB885A014EB702A63F7FA9CC6CCA0DB582E536FEBC8E7830553808251C562E470CD8117B221699D968F31E8A5AB080ECBECFA06E19453E299148682C8C334DC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4C4ABBEFBEE1C868.TMP

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08160234104249947
Encrypted:	false
SSDEEP:	3:OH/V4pyH/zx8OblKlclllv/nt+lybltll1lRsltFll2/lsllccH/GAQH/T:t8j4UFAl3+tsEF
MD5:	59DBC264E4F0B94552A12231A8E3A65D
SHA1:	4ADB6B344FEFBB3B4848FFB34EA90DD1435616DA
SHA-256:	82219EF138105595B79740BE6E8C285E8B9F83623DD2011ABFC7B28FDB121BA6
SHA-512:	CD80CFFA53A237BEE1A11994DFDA8F28EDD5AD90E2C1F0D74CFC7109135833E4AEE7E7320135356B6A8FB50E3513D17D2B43FD58149B646EEC556AB2EAC5FEF2
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms (copy)

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	3440
Entropy (8bit):	3.197581154518287
Encrypted:	false
SSDEEP:	48:MdlNvhUIU9GrIovVASFXdlNvhUID683GrIoHXz1:AvCD9SOmvCA3SJ
MD5:	F37CF783A60D0DB22ED86D95722976BD
SHA1:	A98786DAF3A67D22A79276B723B5241328A1B26E
SHA-256:	E606B2DD1C8574E0FBB0D6001DF555B080EB357A903F131CE1BD3831B507DD1C
SHA-512:	87473A91BF96849D1489F9D0BAA1970123519DE9C15A350262ABF12653694889BD71273244ECA2DB8BD97F93F74B2CF88AE41D4F032F75869304BE9D4A91044C
Malicious:	false
Preview:	...................................FL..................F.@.. ....L..0......U.+...L..0...............................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....(Um...INTERN~1..T......O.I_Y.l...........................b..I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.....f.2....(U.. .iexplore.exe..J......(U.._Y.l.....m..........\|.........$.k.i.e.x.p.l.o.r.e...e.x.e.......^...............-.......]...........{..).....C:\Program Files\Internet Explorer\iexplore.exe....-.p.r.i.v.a.t.e...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.I.E.F.R.A.M.E...d.l.l.........%SystemRoot%\SYSTEM32\IEFRAME.dll...................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.Y.S.T.E.M.3.2.\.I

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms~RF510d0.TMP (copy)

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	3440
Entropy (8bit):	3.197581154518287
Encrypted:	false
SSDEEP:	48:MdlNvhUIU9GrIovVASFXdlNvhUID683GrIoHXz1:AvCD9SOmvCA3SJ
MD5:	F37CF783A60D0DB22ED86D95722976BD
SHA1:	A98786DAF3A67D22A79276B723B5241328A1B26E
SHA-256:	E606B2DD1C8574E0FBB0D6001DF555B080EB357A903F131CE1BD3831B507DD1C
SHA-512:	87473A91BF96849D1489F9D0BAA1970123519DE9C15A350262ABF12653694889BD71273244ECA2DB8BD97F93F74B2CF88AE41D4F032F75869304BE9D4A91044C
Malicious:	false
Preview:	...................................FL..................F.@.. ....L..0......U.+...L..0...............................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....(Um...INTERN~1..T......O.I_Y.l...........................b..I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.....f.2....(U.. .iexplore.exe..J......(U.._Y.l.....m..........\|.........$.k.i.e.x.p.l.o.r.e...e.x.e.......^...............-.......]...........{..).....C:\Program Files\Internet Explorer\iexplore.exe....-.p.r.i.v.a.t.e...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.I.E.F.R.A.M.E...d.l.l.........%SystemRoot%\SYSTEM32\IEFRAME.dll...................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.Y.S.T.E.M.3.2.\.I

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M925D3GEDGLRFZX1LVWS.temp

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	3440
Entropy (8bit):	3.197581154518287
Encrypted:	false
SSDEEP:	48:MdlNvhUIU9GrIovVASFXdlNvhUID683GrIoHXz1:AvCD9SOmvCA3SJ
MD5:	F37CF783A60D0DB22ED86D95722976BD
SHA1:	A98786DAF3A67D22A79276B723B5241328A1B26E
SHA-256:	E606B2DD1C8574E0FBB0D6001DF555B080EB357A903F131CE1BD3831B507DD1C
SHA-512:	87473A91BF96849D1489F9D0BAA1970123519DE9C15A350262ABF12653694889BD71273244ECA2DB8BD97F93F74B2CF88AE41D4F032F75869304BE9D4A91044C
Malicious:	false
Preview:	...................................FL..................F.@.. ....L..0......U.+...L..0...............................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....(Um...INTERN~1..T......O.I_Y.l...........................b..I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.....f.2....(U.. .iexplore.exe..J......(U.._Y.l.....m..........\|.........$.k.i.e.x.p.l.o.r.e...e.x.e.......^...............-.......]...........{..).....C:\Program Files\Internet Explorer\iexplore.exe....-.p.r.i.v.a.t.e...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.I.E.F.R.A.M.E...d.l.l.........%SystemRoot%\SYSTEM32\IEFRAME.dll...................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.Y.S.T.E.M.3.2.\.I

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SB4AAY81SXRWD1OOVZ5Z.temp

Download File

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	3440
Entropy (8bit):	3.196573005293557
Encrypted:	false
SSDEEP:	48:NdlNvhUIU9GrIovVASFXdlNvhUID683GrIoHXz1:bvCD9SOmvCA3SJ
MD5:	3E528E7001B10F87C628851E4A00B197
SHA1:	F28AEC38618F60B7BC9301D13AA7FE97971D2765
SHA-256:	7F7D469D423F75FF2D55591987A7A003524B88EEF69F5DDC7AFAA04358D6D188
SHA-512:	51018AEB83F504FD6A94E1C0336293E42D3D64F190C5CECBF2C3667E8BA0E805BEA0379BC72D78084156A516BF7319F37A0316C1DB403F30A93CC88E2AD4C6A4
Malicious:	false
Preview:	...................................FL..................F.@.. ....L..0......U.+...L..0...............................P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_Y.l....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1.....(Um...INTERN~1..T......O.I_Y.l...........................b..I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.....f.2....(U.. .iexplore.exe..J......(U.._Y.l.....m..........\|.........$.k.i.e.x.p.l.o.r.e...e.x.e.......^...............-.......]...........{..).....C:\Program Files\Internet Explorer\iexplore.exe....-.p.r.i.v.a.t.e...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.I.E.F.R.A.M.E...d.l.l.........%SystemRoot%\SYSTEM32\IEFRAME.dll...................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.Y.S.T.E.M.3.2.\.I

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\U6ghPv3E7k.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	44
Entropy (8bit):	5.033184175406308
Encrypted:	false
SSDEEP:	3:7/YkttmNFjESjHH7HBY:7Nt462bu
MD5:	52005468EE51D684E8D726ECA3C07F4D
SHA1:	D8B11B8F88065A89388ECDE317519CA562E6FE49
SHA-256:	FC309DC28B9FA00BFB9FCB66FC0BA34D574D2BC278B294CC473044116EEC53F8
SHA-512:	F725D1D500A98D7BAD4408B5662405D30394B892B5A7A5C0A739B878F619E51810658266DFAC6C266488EA46D2845D29F248921F400B9506690570E1411053D7
Malicious:	false
Preview:	+1Z2m5QzOHnneu2SJpWFUFh35bqRIb/9oEkewHYvR24=

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.05692913454477
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	U6ghPv3E7k.exe
File size:	576'000 bytes
MD5:	00ba1e1d154e18d1124d87934fae9f20
SHA1:	41bfc98b2b24f4f70852f2de62c08e3c2aaf85ad
SHA256:	3c9bc8ec388807318127107c760233483bbba43a9c186eb7ed794d8fe4ffeb44
SHA512:	8cdf2952bd464f459fea335c6e79f52884aedbebd967a41cd97c27ba1f49c10093c2545b5abcca6275199aaa4c49ad64b12c671cccb2e7f3995faed190fdb9cc
SSDEEP:	12288:wrehgmo0WYgeWYg955/155/e/MxDuFB45w8xD2ovd9:wrehMsMoFBI3p209
TLSH:	40C4F43A62D4F1E5E066903CC84275F6E6727CD8CF1186DFAA94BE567E325F0193AB00
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............\|.V.\|.V.\|.V...W.\|.V...WJ\|.Vy..W.\|.Vy..W.\|.Vy..W.\|.V...W.\|.V...W.\|.V.\|.VA\|.Vw..W.\|.Vw..W.\|.Vw..W.\|.Vw.4V.\|.Vw..W.\|.VRich.\|.

File Icon


Icon Hash:	2bec8caecc6c2b86

Static PE Info

General

Entrypoint:	0x140024338
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x671A6A5D [Thu Oct 24 15:40:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d41245333f8603e0e59f39f6ce5f573b

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FA154E03B88h
dec eax
add esp, 28h
jmp 00007FA154E030F7h
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
push edi
dec eax
sub esp, 20h
mov edx, 00000FA0h
dec eax
lea ecx, dword ptr [0004F24Eh]
call dword ptr [0002DEB8h]
dec eax
lea ecx, dword ptr [000308F1h]
call dword ptr [0002DE83h]
dec eax
mov ebx, eax
dec eax
test eax, eax
jne 00007FA154E03297h
dec eax
lea ecx, dword ptr [0003042Ch]
call dword ptr [0002DE6Eh]
dec eax
mov ebx, eax
dec eax
test eax, eax
je 00007FA154E03301h
dec eax
lea edx, dword ptr [000306EFh]
dec eax
mov ecx, ebx
call dword ptr [0002DE5Eh]
dec eax
lea edx, dword ptr [000306BFh]
dec eax
mov ecx, ebx
dec eax
mov edi, eax
call dword ptr [0002DE4Bh]
dec eax
test edi, edi
je 00007FA154E03297h
dec eax
test eax, eax
je 00007FA154E03292h
dec eax
mov dword ptr [0004F212h], edi
dec eax
mov dword ptr [0004F213h], eax
jmp 00007FA154E032A0h
inc ebp
xor ecx, ecx
inc ebp
xor eax, eax
xor ecx, ecx
inc ecx
lea edx, dword ptr [ecx+01h]
call dword ptr [0002DE5Fh]
dec eax
mov dword ptr [0004F1C0h], eax
dec eax
test eax, eax
je 00007FA154E032A6h
xor ecx, ecx
call 00007FA154E02D25h
test al, al
je 00007FA154E0329Bh
dec eax
lea ecx, dword ptr [0000001Dh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6ee78	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7d000	0x156a9	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x76000	0x4548	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x93000	0x1144	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x64aa0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x64b00	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x64960	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x52000	0x448	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x502e4	0x50400	df003863cf76063a0c3c8b781717ce24	False	0.5187250535436138	data	6.48899250595572	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x52000	0x1dc74	0x1de00	984fb9e779b583760586a8e241601f75	False	0.41123496338912136	data	5.040083060952944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x70000	0x5b28	0x2e00	723ab00cb35ad5e9796cc9670b0fae1b	False	0.16805366847826086	data	4.031587734903732	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x76000	0x4548	0x4600	b9e9391e381e3a2d75874bb619790f3d	False	0.4786830357142857	data	5.65347773255456	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.msvcjmc	0x7b000	0x28b	0x400	7ecebdaafe87386a24fcecfd38060ff9	False	0.01953125	Targa image data - Map (257-257) 257 x 257 x 1 +257 +257 - 1-bit alpha "\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001\001"	0.9461608308144216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x7c000	0x15c	0x200	1ecdd21de31546ab16fc30a1f941ed05	False	0.40625	data	3.322564532023261	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7d000	0x156a9	0x15800	af6263ef071db27365cc57a65a97e9f1	False	0.0866188226744186	data	2.1499530063549184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x93000	0x1144	0x1200	2a5fd688c7619d7906b4c33de5d5fd6a	False	0.4077690972222222	data	5.390730016539296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x7d528	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024			0.23049645390070922
RT_ICON	0x7d990	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600			0.19476744186046513
RT_ICON	0x7e048	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304			0.14672131147540984
RT_ICON	0x7e9d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.1198405253283302
RT_ICON	0x7fa78	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6400			0.09437869822485206
RT_ICON	0x814e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.08246887966804979
RT_ICON	0x83a88	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384			0.06170288143599433
RT_ICON	0x87cb0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024			0.23049645390070922
RT_ICON	0x88118	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1600			0.19476744186046513
RT_ICON	0x887d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304			0.14672131147540984
RT_ICON	0x89158	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.1198405253283302
RT_ICON	0x8a200	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6400			0.09437869822485206
RT_ICON	0x8bc68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.08246887966804979
RT_ICON	0x8e210	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384			0.06170288143599433
RT_GROUP_ICON	0x92438	0x14	data			1.1
RT_GROUP_ICON	0x9244c	0x14	data			1.25
RT_GROUP_ICON	0x92460	0x14	data			1.25
RT_GROUP_ICON	0x92474	0x14	data			1.2
RT_GROUP_ICON	0x92488	0x14	data			1.25
RT_GROUP_ICON	0x9249c	0x14	data			1.25
RT_GROUP_ICON	0x924b0	0x14	data			1.25
RT_GROUP_ICON	0x924c4	0x68	data			0.7884615384615384
RT_MANIFEST	0x9252c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	DecodePointer, CloseHandle, GetLastError, CreatePipe, InitializeCriticalSectionEx, DeleteCriticalSection, WaitForSingleObject, Sleep, CreateProcessW, GetConsoleWindow, WriteFile, QueryPerformanceFrequency, QueryPerformanceCounter, WriteConsoleW, SetStdHandle, GetProcessHeap, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, ReadFile, GetFileSize, CreateFileW, SetLastError, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, HeapSize, HeapReAlloc, ReadConsoleW, SetFilePointerEx, GetFileSizeEx, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, GetFileType, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, EnterCriticalSection, LeaveCriticalSection, GetCurrentThreadId, WideCharToMultiByte, EncodePointer, MultiByteToWideChar, LCMapStringEx, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetStringTypeW, GetCPInfo, InitializeSListHead, InitializeCriticalSectionAndSpinCount, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetCurrentProcessId, OutputDebugStringW, RaiseException, RtlPcToFileHeader, RtlUnwindEx, InterlockedPushEntrySList, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, GetCommandLineA, GetCommandLineW, HeapFree, HeapAlloc, RtlUnwind
USER32.dll	GetSystemMetrics, ShowWindow, ReleaseDC, GetDC
GDI32.dll	DeleteObject, DeleteDC, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt, SelectObject
ole32.dll	CoUninitialize, CoCreateInstance, CoInitialize, CreateStreamOnHGlobal
OLEAUT32.dll	SysAllocString, SysFreeString, SysStringLen, SafeArrayCreate, SafeArrayAccessData, SafeArrayUnaccessData, VariantInit, VariantClear
SHLWAPI.dll	PathFileExistsW
gdiplus.dll	GdipDisposeImage, GdipCreateBitmapFromHBITMAP, GdipGetImageEncodersSize, GdipCloneImage, GdipGetImageEncoders, GdiplusShutdown, GdiplusStartup, GdipFree, GdipSaveImageToStream, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T14:32:37.044546+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.5	49708	TCP
2024-10-31T14:33:15.592916+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.5	49931	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 14:32:32.629394054 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:32.629445076 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:32.629511118 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:32.630614042 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:32.630656958 CET	443	49705	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:32.630709887 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:32.635385990 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:32.635404110 CET	443	49705	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:32.635468006 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:32.635487080 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:33.872625113 CET	443	49705	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:33.872725964 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:33.882941961 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:33.883052111 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:33.929968119 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:33.930001974 CET	443	49705	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:33.930198908 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:33.930222988 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:33.930434942 CET	443	49705	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:33.930495024 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:33.931066036 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:33.931133986 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:33.932679892 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:33.979330063 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:34.227291107 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:34.228317976 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:34.228343964 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:34.228400946 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:34.388215065 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:34.388326883 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:34.388372898 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:34.388430119 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:34.442630053 CET	49704	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:34.442651987 CET	443	49704	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:35.021384001 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:35.067342997 CET	443	49705	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:35.331190109 CET	443	49705	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:35.331254005 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:35.331279039 CET	443	49705	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:35.331321955 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:35.338838100 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:35.338897943 CET	443	49705	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:35.338953018 CET	49705	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.017484903 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.017505884 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.017680883 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.017750978 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.017771006 CET	443	49717	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.017962933 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.018192053 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.018202066 CET	443	49717	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.018773079 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.018785954 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.937782049 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.937911034 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.948220968 CET	443	49717	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.948317051 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.957881927 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.957881927 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.957899094 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.957911968 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958076000 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958091021 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958096027 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958100080 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958164930 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958168983 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958415031 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958431959 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958445072 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958451033 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958486080 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958493948 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958514929 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958514929 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958523989 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958534956 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958575964 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958586931 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958640099 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958650112 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958700895 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958709002 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958729982 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958749056 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958759069 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958770037 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958813906 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958825111 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958853006 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958859921 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958863020 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958865881 CET	443	49717	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.958894968 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.958913088 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959106922 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959120989 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959194899 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959208012 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959235907 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959248066 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959274054 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959274054 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959290981 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959296942 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959378958 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959391117 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959445953 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959455967 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959479094 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959484100 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959512949 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959520102 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959534883 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959546089 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959553957 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959558010 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959582090 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959593058 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959691048 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959700108 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959714890 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959723949 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959742069 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959750891 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959817886 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959829092 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959909916 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959919930 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.959932089 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.959948063 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960004091 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960015059 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960035086 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960042000 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960418940 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960427999 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960444927 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960450888 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960470915 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960480928 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960591078 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960599899 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960617065 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960624933 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960649014 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960658073 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960674047 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960680962 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960689068 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960695028 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960721970 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960721970 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960733891 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960743904 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:37.960756063 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960779905 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960793018 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960851908 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.960916996 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:37.968533039 CET	443	49716	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:38.214229107 CET	49716	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:38.217456102 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:38.217473030 CET	443	49717	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:38.603193045 CET	443	49717	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:38.606327057 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:38.606338024 CET	443	49717	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:38.606703997 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:38.627409935 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:38.627443075 CET	443	49717	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:38.627563000 CET	443	49717	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:38.627646923 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:38.627646923 CET	49717	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:40.068980932 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:40.069013119 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:40.072643995 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:40.073105097 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:40.073112011 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.031689882 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.031790018 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.052717924 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.052735090 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.053709984 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.053788900 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.054691076 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.054924965 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.054970980 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.055053949 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.055073977 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.055097103 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.055306911 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.055532932 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.055636883 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.055659056 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.055752993 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.055768013 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.055788994 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.055800915 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.055815935 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.055828094 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.055934906 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.055973053 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.056037903 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056050062 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.056107044 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056114912 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.056128979 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056143999 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.056163073 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056195974 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.056353092 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056372881 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.056427002 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056453943 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056509972 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056521893 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056540966 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.056543112 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056592941 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056612015 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056622028 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.056622982 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056668043 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056683064 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056699038 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056746960 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056798935 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056847095 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056868076 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.056921959 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.070432901 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.070693016 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.070704937 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.070718050 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.070729971 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.070735931 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.070792913 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.070888042 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.070924044 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.070954084 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.070969105 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.071026087 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071099043 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071109056 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.071111917 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071141005 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071154118 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071157932 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.071166992 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071212053 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071233034 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071270943 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.071270943 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071322918 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071332932 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.071408033 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:41.071413040 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.071460009 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:41.084338903 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:42.180635929 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:42.180816889 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:42.180840969 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:42.180974960 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:42.183053970 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:42.183118105 CET	443	49734	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:42.183258057 CET	49734	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:46.430035114 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:46.430078030 CET	443	49771	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:46.430238962 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:46.430767059 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:46.430783033 CET	443	49771	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:47.393398046 CET	443	49771	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:47.393477917 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:47.395499945 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:47.395509958 CET	443	49771	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:47.396296978 CET	443	49771	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:47.396354914 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:47.396814108 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:47.443334103 CET	443	49771	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:47.811772108 CET	443	49771	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:47.811836958 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:47.811865091 CET	443	49771	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:47.811906099 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:47.814239025 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:47.814354897 CET	443	49771	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:47.814408064 CET	49771	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:52.889672041 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:52.889714956 CET	443	49807	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:52.890006065 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:52.890290976 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:52.890306950 CET	443	49807	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:53.814177036 CET	443	49807	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:53.814292908 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:53.818058968 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:53.818064928 CET	443	49807	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:53.818394899 CET	443	49807	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:53.818497896 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:53.818947077 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:53.863337994 CET	443	49807	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:54.228492975 CET	443	49807	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:54.228574991 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:54.228598118 CET	443	49807	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:54.228698015 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:54.229263067 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:54.229346991 CET	443	49807	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:54.229449034 CET	49807	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:57.920269012 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:57.920316935 CET	443	49835	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:57.920587063 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:57.920826912 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:57.920844078 CET	443	49835	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:58.843990088 CET	443	49835	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:58.844064951 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:58.845916033 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:58.845923901 CET	443	49835	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:58.846169949 CET	443	49835	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:58.846271038 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:58.846620083 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:58.891330957 CET	443	49835	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:59.242347002 CET	443	49835	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:59.242403030 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:59.242423058 CET	443	49835	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:59.242469072 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:59.243036032 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:59.243071079 CET	443	49835	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:59.243191957 CET	443	49835	89.221.225.227	192.168.2.5
Oct 31, 2024 14:32:59.243230104 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:32:59.243252039 CET	49835	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:02.961605072 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:02.961661100 CET	443	49865	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:02.961829901 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:02.963577032 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:02.963589907 CET	443	49865	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:03.923405886 CET	443	49865	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:03.923485041 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:03.925645113 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:03.925676107 CET	443	49865	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:03.925910950 CET	443	49865	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:03.925971031 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:03.926374912 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:03.971334934 CET	443	49865	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:04.331264019 CET	443	49865	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:04.331329107 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:04.331362009 CET	443	49865	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:04.331669092 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:04.338082075 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:04.338116884 CET	443	49865	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:04.338191986 CET	49865	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:09.405288935 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:09.405323029 CET	443	49901	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:09.405462027 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:09.405772924 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:09.405787945 CET	443	49901	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:10.336751938 CET	443	49901	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:10.336864948 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:10.338427067 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:10.338442087 CET	443	49901	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:10.338759899 CET	443	49901	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:10.338850021 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:10.339217901 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:10.383322954 CET	443	49901	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:10.753529072 CET	443	49901	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:10.753634930 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:10.753647089 CET	443	49901	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:10.754297018 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:10.754631042 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:10.754673004 CET	443	49901	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:10.754798889 CET	49901	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:14.436544895 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:14.436604023 CET	443	49932	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:14.436693907 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:14.436953068 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:14.436974049 CET	443	49932	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:15.591754913 CET	443	49932	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:15.591950893 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:15.594129086 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:15.594160080 CET	443	49932	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:15.594445944 CET	443	49932	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:15.595082045 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:15.595438957 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:15.643325090 CET	443	49932	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:16.023009062 CET	443	49932	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:16.023087025 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:16.023117065 CET	443	49932	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:16.023159981 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:16.024740934 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:16.024792910 CET	443	49932	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:16.024861097 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:16.024883986 CET	49932	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:19.596554995 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:19.596606016 CET	443	49961	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:19.596672058 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:19.597351074 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:19.597363949 CET	443	49961	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:20.537040949 CET	443	49961	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:20.537101984 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:20.539196014 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:20.539206028 CET	443	49961	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:20.539540052 CET	443	49961	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:20.539601088 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:20.539974928 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:20.583339930 CET	443	49961	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:20.955230951 CET	443	49961	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:20.955291033 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:20.955307961 CET	443	49961	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:20.955367088 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:20.955948114 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:20.955986023 CET	443	49961	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:20.956048965 CET	49961	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:26.029587984 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:26.029639006 CET	443	49997	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:26.029819012 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:26.031122923 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:26.031145096 CET	443	49997	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:27.529562950 CET	443	49997	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:27.529686928 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:27.531606913 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:27.531613111 CET	443	49997	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:27.531868935 CET	443	49997	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:27.531913996 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:27.532506943 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:27.579336882 CET	443	49997	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:27.950289011 CET	443	49997	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:27.950375080 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:27.950392962 CET	443	49997	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:27.950597048 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:27.953501940 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:27.953552008 CET	443	49997	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:27.953707933 CET	49997	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:33.014472961 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:33.014528990 CET	443	49999	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:33.014597893 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:33.014945984 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:33.014965057 CET	443	49999	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:33.939069986 CET	443	49999	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:33.939133883 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:33.940851927 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:33.940862894 CET	443	49999	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:33.941160917 CET	443	49999	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:33.941217899 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:33.941551924 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:33.987328053 CET	443	49999	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:34.365169048 CET	443	49999	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:34.365247965 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:34.365262985 CET	443	49999	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:34.365358114 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:34.365948915 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:34.366020918 CET	443	49999	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:34.366179943 CET	49999	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:38.077980042 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:38.078032970 CET	443	50000	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:38.078357935 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:38.078794956 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:38.078809023 CET	443	50000	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:39.007920980 CET	443	50000	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:39.008033991 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:39.009979010 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:39.009989023 CET	443	50000	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:39.010261059 CET	443	50000	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:39.010395050 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:39.011121988 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:39.051338911 CET	443	50000	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:39.429786921 CET	443	50000	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:39.429874897 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:39.429888010 CET	443	50000	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:39.429975033 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:39.430510044 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:39.430550098 CET	443	50000	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:39.430600882 CET	50000	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:43.110687971 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:43.110727072 CET	443	50002	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:43.110826015 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:43.111164093 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:43.111179113 CET	443	50002	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:44.040235996 CET	443	50002	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:44.040338993 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:44.043251991 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:44.043263912 CET	443	50002	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:44.043512106 CET	443	50002	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:44.043629885 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:44.044269085 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:44.091322899 CET	443	50002	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:44.482737064 CET	443	50002	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:44.482800007 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:44.482811928 CET	443	50002	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:44.482892990 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:44.483546972 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:44.483614922 CET	443	50002	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:44.483679056 CET	50002	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:48.139600992 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:48.139633894 CET	443	50003	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:48.139750957 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:48.139965057 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:48.139976025 CET	443	50003	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:49.099854946 CET	443	50003	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:49.099944115 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:49.101799011 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:49.101810932 CET	443	50003	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:49.102092981 CET	443	50003	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:49.102153063 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:49.102524042 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:49.147336960 CET	443	50003	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:50.753177881 CET	443	50003	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:50.753308058 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:50.753334999 CET	443	50003	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:50.753400087 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:50.754292965 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:50.754328966 CET	443	50003	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:50.754374981 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:50.754400969 CET	50003	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:53.170576096 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:53.170619011 CET	443	50004	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:53.171153069 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:53.171513081 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:53.171526909 CET	443	50004	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:54.101461887 CET	443	50004	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:54.101548910 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:54.103486061 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:54.103497982 CET	443	50004	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:54.104201078 CET	443	50004	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:54.104579926 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:54.105025053 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:54.151333094 CET	443	50004	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:54.518461943 CET	443	50004	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:54.518758059 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:54.518788099 CET	443	50004	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:54.518836975 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:54.519401073 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:54.519443989 CET	443	50004	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:54.519507885 CET	50004	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:58.206895113 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:58.206949949 CET	443	50005	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:58.207158089 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:58.207468987 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:58.207480907 CET	443	50005	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:59.139250994 CET	443	50005	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:59.139324903 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:59.140917063 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:59.140924931 CET	443	50005	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:59.141129971 CET	443	50005	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:59.141181946 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:59.141634941 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:59.187335968 CET	443	50005	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:59.569559097 CET	443	50005	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:59.569823027 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:59.569839954 CET	443	50005	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:59.569948912 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:59.571062088 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:33:59.571099043 CET	443	50005	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:59.571224928 CET	443	50005	89.221.225.227	192.168.2.5
Oct 31, 2024 14:33:59.571291924 CET	50005	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:03.250406981 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:03.250452042 CET	443	50006	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:03.250514984 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:03.250938892 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:03.250952005 CET	443	50006	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:04.177736998 CET	443	50006	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:04.178196907 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:04.179749012 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:04.179760933 CET	443	50006	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:04.179972887 CET	443	50006	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:04.180044889 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:04.180578947 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:04.223325968 CET	443	50006	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:04.595660925 CET	443	50006	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:04.595733881 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:04.595756054 CET	443	50006	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:04.596066952 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:04.596580982 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:04.596625090 CET	443	50006	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:04.596704960 CET	50006	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:08.279350996 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:08.279401064 CET	443	50007	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:08.279632092 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:08.279970884 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:08.279978037 CET	443	50007	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:09.205635071 CET	443	50007	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:09.205710888 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:09.207232952 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:09.207238913 CET	443	50007	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:09.207464933 CET	443	50007	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:09.207520008 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:09.208219051 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:09.251338959 CET	443	50007	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:09.628765106 CET	443	50007	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:09.632158995 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:09.632164955 CET	443	50007	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:09.632210016 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:09.642095089 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:09.642129898 CET	443	50007	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:09.642169952 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:09.642210960 CET	50007	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:13.312818050 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:13.312860012 CET	443	50008	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:13.312922001 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:13.313292980 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:13.313304901 CET	443	50008	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:14.250062943 CET	443	50008	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:14.250175953 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:14.252103090 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:14.252110958 CET	443	50008	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:14.252345085 CET	443	50008	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:14.252398014 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:14.252846003 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:14.295329094 CET	443	50008	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:14.669039965 CET	443	50008	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:14.670412064 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:14.670428991 CET	443	50008	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:14.670557022 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:14.670697927 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:14.670743942 CET	443	50008	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:14.670804024 CET	50008	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:19.761293888 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:19.761332989 CET	443	50009	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:19.761481047 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:19.762273073 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:19.762285948 CET	443	50009	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:20.683223009 CET	443	50009	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:20.683290958 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:20.685048103 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:20.685065031 CET	443	50009	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:20.685323000 CET	443	50009	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:20.685378075 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:20.685731888 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:20.731328964 CET	443	50009	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:21.098238945 CET	443	50009	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:21.098299026 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:21.098325968 CET	443	50009	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:21.098367929 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:21.100317955 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:21.100358963 CET	443	50009	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:21.100411892 CET	50009	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:26.179254055 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:26.179292917 CET	443	50010	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:26.179361105 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:26.179681063 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:26.179694891 CET	443	50010	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:27.151654959 CET	443	50010	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:27.151738882 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:27.154572010 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:27.154591084 CET	443	50010	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:27.155441999 CET	443	50010	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:27.155517101 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:27.156424046 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:27.203330040 CET	443	50010	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:27.585485935 CET	443	50010	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:27.585560083 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:27.585586071 CET	443	50010	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:27.585726976 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:27.586380005 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:27.586456060 CET	443	50010	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:27.586689949 CET	50010	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:32.658437967 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:32.658487082 CET	443	50011	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:32.662386894 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:32.666429043 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:32.666467905 CET	443	50011	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:33.584237099 CET	443	50011	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:33.584325075 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:33.604540110 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:33.604568005 CET	443	50011	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:33.604860067 CET	443	50011	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:33.604914904 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:33.605547905 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:33.647341967 CET	443	50011	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:34.009924889 CET	443	50011	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:34.009999037 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:34.010025024 CET	443	50011	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:34.010071039 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:34.019303083 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:34.019409895 CET	443	50011	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:34.019481897 CET	50011	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:37.688153982 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:37.688210011 CET	443	50012	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:37.688357115 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:37.690295935 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:37.690330029 CET	443	50012	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:38.620732069 CET	443	50012	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:38.620816946 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:38.622658014 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:38.622678041 CET	443	50012	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:38.622884035 CET	443	50012	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:38.623014927 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:38.623475075 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:38.671339989 CET	443	50012	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:39.044970989 CET	443	50012	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:39.045100927 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:39.045133114 CET	443	50012	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:39.046452999 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:39.051894903 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:39.051956892 CET	443	50012	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:39.052086115 CET	443	50012	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:39.052155972 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:39.052177906 CET	50012	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:44.415759087 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:44.415806055 CET	443	50013	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:44.415877104 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:44.418065071 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:44.418077946 CET	443	50013	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:45.355036974 CET	443	50013	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:45.355103970 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:45.356728077 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:45.356735945 CET	443	50013	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:45.356955051 CET	443	50013	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:45.357011080 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:45.357592106 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:45.403330088 CET	443	50013	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:45.804728985 CET	443	50013	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:45.804812908 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:45.804832935 CET	443	50013	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:45.804872990 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:45.806476116 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:45.806513071 CET	443	50013	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:45.806629896 CET	443	50013	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:45.806642056 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:45.806670904 CET	50013	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:50.858344078 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:50.858403921 CET	443	50014	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:50.858529091 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:50.858721972 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:50.858743906 CET	443	50014	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:51.789885044 CET	443	50014	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:51.789968014 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:51.791627884 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:51.791641951 CET	443	50014	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:51.791893005 CET	443	50014	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:51.791963100 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:51.792289972 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:51.839334965 CET	443	50014	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:52.251557112 CET	443	50014	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:52.251643896 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:52.251677036 CET	443	50014	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:52.251717091 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:52.252295017 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:52.252341032 CET	443	50014	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:52.252484083 CET	443	50014	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:52.252490997 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:52.252523899 CET	50014	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:55.892472982 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:55.892525911 CET	443	50015	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:55.898384094 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:55.899085045 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:55.899096966 CET	443	50015	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:56.832598925 CET	443	50015	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:56.832680941 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:56.834475994 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:56.834485054 CET	443	50015	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:56.834744930 CET	443	50015	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:56.834810972 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:56.835247040 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:56.879332066 CET	443	50015	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:57.254431009 CET	443	50015	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:57.254561901 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:57.254579067 CET	443	50015	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:57.254621983 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:57.255145073 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:34:57.255228043 CET	443	50015	89.221.225.227	192.168.2.5
Oct 31, 2024 14:34:57.255285978 CET	50015	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:00.921137094 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:00.921179056 CET	443	50016	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:00.921446085 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:00.921956062 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:00.921969891 CET	443	50016	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:01.849864960 CET	443	50016	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:01.849991083 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:01.856602907 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:01.856621981 CET	443	50016	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:01.856816053 CET	443	50016	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:01.856888056 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:01.857489109 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:01.903371096 CET	443	50016	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:02.275192022 CET	443	50016	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:02.275240898 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:02.275258064 CET	443	50016	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:02.276725054 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:02.286560059 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:02.286598921 CET	443	50016	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:02.286653996 CET	50016	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:05.952192068 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:05.952240944 CET	443	50017	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:05.952547073 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:05.953022957 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:05.953035116 CET	443	50017	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:06.897577047 CET	443	50017	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:06.897644043 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:06.899786949 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:06.899800062 CET	443	50017	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:06.900053978 CET	443	50017	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:06.900103092 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:06.900520086 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:06.947331905 CET	443	50017	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:07.302395105 CET	443	50017	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:07.302472115 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:07.302500010 CET	443	50017	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:07.302619934 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:07.303049088 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:07.303096056 CET	443	50017	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:07.303242922 CET	50017	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:11.097611904 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:11.097655058 CET	443	50018	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:11.097791910 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:11.101739883 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:11.101757050 CET	443	50018	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:12.031153917 CET	443	50018	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:12.031250000 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:12.033247948 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:12.033257961 CET	443	50018	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:12.033473969 CET	443	50018	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:12.033546925 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:12.033967018 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:12.079330921 CET	443	50018	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:12.430943012 CET	443	50018	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:12.431020975 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:12.431037903 CET	443	50018	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:12.431094885 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:12.431909084 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:12.431953907 CET	443	50018	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:12.432024956 CET	50018	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:17.484833002 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:17.484875917 CET	443	50019	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:17.484965086 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:17.485336065 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:17.485342979 CET	443	50019	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:18.416492939 CET	443	50019	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:18.416610003 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:18.418260098 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:18.418268919 CET	443	50019	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:18.418467999 CET	443	50019	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:18.418543100 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:18.418983936 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:18.463337898 CET	443	50019	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:18.845758915 CET	443	50019	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:18.845851898 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:18.845860958 CET	443	50019	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:18.845910072 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:18.846766949 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:18.846806049 CET	443	50019	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:18.847330093 CET	443	50019	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:18.847388983 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:18.847407103 CET	50019	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:23.322515011 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:23.322566986 CET	443	50020	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:23.322639942 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:23.323049068 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:23.323065996 CET	443	50020	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:24.280961037 CET	443	50020	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:24.281249046 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:24.282689095 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:24.282701015 CET	443	50020	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:24.282907009 CET	443	50020	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:24.283004045 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:24.283472061 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:24.327373981 CET	443	50020	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:24.699331999 CET	443	50020	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:24.702368021 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:24.702387094 CET	443	50020	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:24.702459097 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:24.702960968 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:24.703011036 CET	443	50020	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:24.703166962 CET	443	50020	89.221.225.227	192.168.2.5
Oct 31, 2024 14:35:24.703353882 CET	50020	443	192.168.2.5	89.221.225.227
Oct 31, 2024 14:35:24.703353882 CET	50020	443	192.168.2.5	89.221.225.227

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 14:32:31.934150934 CET	58816	53	192.168.2.5	1.1.1.1
Oct 31, 2024 14:32:32.619671106 CET	53	58816	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 14:32:31.934150934 CET	192.168.2.5	1.1.1.1	0x7104	Standard query (0)	vacationtogotravels.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 14:32:32.619671106 CET	1.1.1.1	192.168.2.5	0x7104	No error (0)	vacationtogotravels.net		89.221.225.227	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

vacationtogotravels.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:32:33 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:32:33 UTC	8	OUT	Data Raw: 26 61 ab 21 10 03 00 00 Data Ascii: &a!
2024-10-31 13:32:34 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:32:34 GMT Connection: close Content-Length: 44
2024-10-31 13:32:34 UTC	44	IN	Data Raw: 2b 31 5a 32 6d 35 51 7a 4f 48 6e 6e 65 75 32 53 4a 70 57 46 55 46 68 33 35 62 71 52 49 62 2f 39 6f 45 6b 65 77 48 59 76 52 32 34 3d Data Ascii: +1Z2m5QzOHnneu2SJpWFUFh35bqRIb/9oEkewHYvR24=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:32:35 UTC	212	OUT	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: vacationtogotravels.net Connection: Keep-Alive
2024-10-31 13:32:35 UTC	312	IN	HTTP/1.1 200 OK Cache-Control: no-cache Content-Type: image/x-icon Last-Modified: Mon, 25 Sep 2023 13:01:08 GMT ETag: "1695646868.0-1150-965286158" Server: Microsoft-IIS/10.0 Content-Disposition: inline; filename=favicon.ico Date: Thu, 31 Oct 2024 13:32:35 GMT Connection: close Content-Length: 1150
2024-10-31 13:32:35 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 12 0b 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ff fe fe fd ff ff ff ff ff ff ff ff ff ff fe fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe ff ff ff ff ff ff ff ff ff ff ff ff ff fc fb f9 ff ff fe fd ff fd fc fc ff ff ff ff ff fe fd fa ff fd fd fc ff ff ff ff ff ff fe fc ff ff fe fb ff fc fc fa ff fe fe fd ff ff ff fe ff ff ff ff ff ff ff fe ff ff fe fd ff ff ff ff ff fb Data Ascii: h(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49716	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:32:37 UTC	326	OUT	POST /upload HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 697244 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:32:37 UTC	16355	OUT	Data Raw: 10 03 00 00 31 16 b5 04 90 a3 0a 00 e1 05 ef 78 8d 71 38 fc b4 07 e1 71 da a6 01 b1 b0 af a5 f0 9a ec ef 34 2a 00 5b 39 7f 3b 47 c4 e1 31 bd 21 da 44 da 0e 7a d4 b4 b6 75 99 e7 d6 fd d3 85 7a 05 0d dc 40 67 ad dc a7 05 46 18 64 52 d7 19 20 49 a6 8e 49 b7 5f 50 71 47 a7 86 18 1d aa fe 4e 12 0c f2 08 73 25 1f cb 35 5c 0c 1e a7 46 87 da 4b 05 73 b5 53 31 39 92 c0 b1 e0 f4 3b 7c 03 7c a1 f8 77 cd 44 2a 80 a5 56 ee 42 cf 73 c4 c5 88 ff 20 74 9b 5a 0f b1 4f d2 1f 52 c0 da ee e6 b9 5d 1b c2 ed ba 10 d8 fd ee ad db 7d 50 bc 78 1d 99 99 43 95 f4 64 77 55 65 ed 85 34 1d f5 ce 02 2e 61 ab 9e 73 da 24 b3 d7 28 bc ca e3 65 6d f6 38 6a a4 1f 61 29 d8 ac 49 f9 28 0c e8 45 04 63 8f 10 de 33 69 ec c7 71 70 72 51 7d 12 98 14 88 68 d0 62 02 2a 5c 67 78 34 b5 a2 d9 5a af 98 Data Ascii: 1xq8q4[9;G1!Dzuz@gFdR II_PqGNs%5\FKsS19;\|\|wDVBs tZOR]}PxCdwUe4.as$(em8ja)I(Ec3iqprQ}hb*\gx4Z
2024-10-31 13:32:37 UTC	16355	OUT	Data Raw: 6a 01 3a 7f 47 bb ba 4e 2a 2d 65 8e 93 67 76 dc c4 b6 73 11 54 d6 f5 fd 0c ea a4 1e 6f 6c 6e 6d e0 b6 22 f8 33 34 6e 7d 05 12 10 53 5b 8a d2 71 1e 23 9a eb 40 bd 24 fd 0f e5 0c 47 12 b0 7a 63 2a 7a d4 df 08 11 9c 73 ed 0e 00 1a 0d c9 cf f0 95 7c fb 96 e4 6a de bd 6c 10 fe 89 c5 4e a1 73 60 51 15 04 a8 e0 68 b8 5a 1f 54 5b 89 b0 6b db 33 e3 47 9a d7 55 45 fd 64 48 e6 0a 23 2a a9 7d f2 f7 56 b4 91 59 38 ab 67 40 1a d1 f9 53 68 e0 6e aa 4a 50 ee 25 d7 74 a6 de 70 a8 c7 ea dc 8f cc 91 5b 7f 67 76 84 30 00 a9 8f b5 b9 ec 04 29 b6 d1 92 7c c4 2d 38 ed 26 3a 3d 5f 66 95 9b aa f8 1c d2 1a a9 b1 07 91 d3 af b4 f2 1f a9 7c 37 e8 a7 c0 12 fa 95 b2 c8 e2 e9 e3 59 f2 b0 a6 fa 44 f6 43 be ed 53 f8 56 32 f6 c0 83 48 20 43 b8 2d d0 67 6e d2 63 af c2 cb d8 1f 1b d2 3f 7b Data Ascii: j:GN-egvsTolnm"34n}S[q#@$Gzczs\|jlNs`QhZT[k3GUEdH#*}VY8g@ShnJP%tp[gv0)\|-8&:=_f\|7YDCSV2H C-gnc?{
2024-10-31 13:32:37 UTC	16355	OUT	Data Raw: 5a 5a eb 47 b7 82 a2 f0 74 4f cd f5 85 7e 6b a1 14 a4 dd d4 ac 34 88 ee 93 55 3f 02 8e 19 03 45 4e 55 30 33 8f 95 d8 11 fa 64 68 da 10 b7 03 ce 79 b4 9e 35 0b 42 2a af 52 3a a8 68 40 1d 23 4a 5b d3 2d 48 b6 be 93 45 a7 f6 6a 83 7b 82 35 db b6 2f e2 cd a8 79 2d d3 ce 8a b1 be 64 20 24 6a 91 0c 44 d4 92 22 18 75 ea 7f ad 24 43 f2 71 3c 59 c2 b7 8a b3 14 4b af 0e c1 7f 38 7b 17 b2 7f 6c 96 28 d7 89 cb 90 d3 3e 42 71 52 d5 5f 88 32 5b 50 a5 c7 d3 b1 4c c8 49 44 b1 6f f3 25 0f 21 aa 22 35 e3 03 a6 2b db 49 15 e6 e9 ce 16 53 c0 fc 35 15 07 c2 a2 57 4c 35 38 4a c5 df aa 4e 0d 48 4b 38 6d d1 93 3a 38 26 49 29 c5 d0 4f 92 2a a8 24 c3 cc 0e 9c 2b 05 86 15 8d 67 98 9a 43 bb 06 a8 76 2b a8 fd 8c 51 b3 00 db d6 d9 fb bc 77 40 eb 02 36 69 36 43 1a 65 d7 97 f5 a2 53 8d Data Ascii: ZZGtO~k4U?ENU03dhy5BR:h@#J[-HEj{5/y-d $jD"u$Cq<YK8{l(>BqR_2[PLIDo%!"5+IS5WL58JNHK8m:8&I)O$+gCv+Qw@6i6CeS
2024-10-31 13:32:37 UTC	16355	OUT	Data Raw: b6 7a 94 77 91 f0 5f 1b 11 94 05 85 12 83 6f 33 af 4b 42 71 5a d5 07 48 fd cd 07 31 d5 45 55 5e 37 2a d9 ad 39 75 b2 d8 7a 5a 20 67 70 b7 00 20 19 32 c7 6e 96 5b 08 40 f1 22 79 d1 01 53 5a d4 12 1a cd 03 d9 dc 2b c3 6d 60 0c b0 5c dc 1d 91 6a e7 a1 98 bd b6 45 1d 59 3d b8 4b 58 68 bb 41 0c 51 88 f9 2c 9d 1d 1d 62 e1 d5 dc 05 c1 59 13 d1 f6 21 40 76 97 3e 4b 60 87 ef f9 1c 06 a7 20 2a 2e 2b 29 5e db a6 22 92 6c 41 70 a8 86 0a b9 7c 36 ca e4 99 13 79 f3 72 4b 07 5b 5c cc 87 f0 18 1b c7 78 8b 68 2c 88 39 b4 fd 95 3e 85 98 a7 fe 32 4e e7 b4 46 a0 f0 bd 27 da 1b 8e c8 82 7d 27 fc 83 34 a8 63 cb be 7f 6d 31 c9 d7 66 1b 75 89 9d ef fb 75 3e c4 37 27 1e 39 13 fb 31 02 b0 5d bf 8f d9 0b 26 55 35 ea 6b 13 46 c5 3b ee ef df bb 74 80 a6 fd 85 09 d8 e4 1d ae 2a 6b 97 Data Ascii: zw_o3KBqZH1EU^79uzZ gp 2n[@"ySZ+m`\jEY=KXhAQ,bY!@v>K` .+)^"lAp\|6yrK[\xh,9>2NF'}'4cm1fuu>7'91]&U5kF;t*k
2024-10-31 13:32:37 UTC	16355	OUT	Data Raw: 6c b7 99 28 2e 6c 69 2f ee 3d 92 82 e2 20 13 ad 96 fb 86 c4 e2 53 45 38 42 b4 0a a1 18 c6 c7 7d dc 11 e4 dc b6 1b 72 10 37 fe 88 2c 1a b9 b2 8d 9a 87 47 79 a2 7d 5f 95 91 ac 93 7c 9f 5a e0 c6 91 a5 65 39 7c ef e3 22 71 95 14 9d 7a 39 b8 76 ea f4 bb 3a 20 fc 6f 6c b4 6e c3 7d 32 e7 6b 2e e5 0c f6 5e a6 31 ad 0b 44 70 4c 3f 5f 23 85 ae e2 8b 46 e9 94 e0 f1 a0 b8 43 db 8d ee e7 a0 a8 dd 8a ab 2f d9 92 1e 07 28 33 89 87 39 36 89 90 a2 3a 5d df 1f e7 2a 5b ec 67 a5 44 b1 bf fd b1 a1 ad b0 a7 fb ef c1 86 1e be 0e 79 c1 91 54 08 a8 fc 57 06 53 86 13 0e cd f7 6e 65 e8 88 c8 14 9e de 6c 93 77 be 9b da 02 dc da 12 67 ab 00 62 78 3f 00 46 c7 56 b9 a5 82 de 91 75 d9 91 e4 1e 9c 21 aa bf 85 e9 69 38 96 c1 14 84 c8 8f 7a b9 e1 ca ec 3e 77 1d 07 8a 48 ce ca 62 96 49 94 Data Ascii: l(.li/= SE8B}r7,Gy}_\|Ze9\|"qz9v: oln}2k.^1DpL?_#FC/(396:]*[gDyTWSnelwgbx?FVu!i8z>wHbI
2024-10-31 13:32:37 UTC	16355	OUT	Data Raw: 37 53 30 9f 5c 69 ad 41 00 49 eb 0d 58 10 da c0 af 72 8c dd 23 1f 62 35 b2 49 c4 c9 2d b9 f5 72 36 32 98 f7 d1 45 b9 6a e4 41 96 1b bf f4 88 da b9 61 17 13 37 8e 2a 82 b3 59 73 eb 18 eb 72 3f 01 86 2f 2e ea a1 fc 51 93 4f a1 6f 47 53 49 1e ac 6b 62 76 7f 5d a9 ad 2e b1 1a 3f a1 57 e4 4c 38 ba 06 8e 32 49 7b c8 0f 2a c9 16 67 de e6 32 7a 6b 8b bd 16 b0 40 35 56 18 b0 aa 1a 30 ad 0f 77 79 24 ef bb d1 30 4b 21 f0 e0 66 af 2c ba 6c a0 e6 51 8a aa 22 65 59 99 9c fc d2 f1 5e 3a f3 ab 97 87 30 30 dc 4f 33 e1 e5 e6 d5 23 5a 1f 56 f8 78 a3 04 23 cb 51 f0 8e 5a d3 17 25 93 a4 0e 0f 50 d3 42 17 5d aa be 57 54 91 04 5f b3 a1 f1 fb 59 86 30 f0 7e 0b 89 fe c5 ef 3e 42 c8 1b 86 fd dc 43 5f 38 bc 39 16 f1 06 ce ae e2 15 2c 26 ea 5b 98 f7 20 2e cc ac 37 5d 41 56 f5 91 63 Data Ascii: 7S0\iAIXr#b5I-r62EjAa7Ysr?/.QOoGSIkbv].?WL82I{g2zk@5V0wy$0K!f,lQ"eY^:00O3#ZVx#QZ%PB]WT_Y0~>BC_89,&[ .7]AVc
2024-10-31 13:32:37 UTC	16355	OUT	Data Raw: 84 bb 0a 75 a4 76 69 02 7c f8 89 ce c2 67 22 4f 65 1c d7 3c 4e e3 61 78 9a fe 5d 46 88 bb 31 58 77 21 3c e7 ed c6 3f 5f 73 10 db 72 25 d9 20 4f d2 a2 59 ac 4e 91 03 93 d4 ea 77 4f be 75 28 fd a5 16 bd bd 71 0d 59 af 31 97 fc e5 d2 9c 37 6f 99 2b b5 04 6e bd ad e0 b2 bd d3 3b 29 e9 cd 48 2c fe bc 4c b2 f9 90 f1 a8 15 c7 b5 80 f2 b4 f7 77 d9 76 6a 85 70 ff 22 e5 e4 8a 36 ec 59 3c 6d 17 a6 e2 ab 4d 64 fa 56 52 b3 6a e3 e1 e6 a0 99 18 f5 3d 33 96 d1 a6 11 ad a9 65 39 12 34 0e a4 74 67 59 9b 7b 97 9f ab e1 2b 48 5b ae 5d ca b7 56 6c d2 2e 5a 88 7c 2f bc 1c 90 4b d0 af 73 5c c2 20 e4 25 9e 32 5a 27 c2 22 57 1a 65 05 1e 6b 97 8a b8 e1 e4 64 12 a8 87 a7 94 f2 6f 4f 44 de 49 7a 36 13 22 7d 59 89 85 d3 c1 5d 7b 47 5a 9c 2c af 26 b0 dd 68 c5 59 8f 56 20 f4 1b ff d0 Data Ascii: uvi\|g"Oe<Nax]F1Xw!<?_sr% OYNwOu(qY17o+n;)H,Lwvjp"6Y<mMdVRj=3e94tgY{+H[]Vl.Z\|/Ks\ %2Z'"WekdoODIz6"}Y]{GZ,&hYV
2024-10-31 13:32:37 UTC	16355	OUT	Data Raw: b9 55 c6 ef 93 c3 0a 45 8a 36 19 21 f4 2b 25 ae 19 32 2a 64 3c e1 bc e8 4c f3 cc 9a 21 bf 83 6f d2 4f b0 27 31 e3 7c 74 30 e8 68 d6 da 86 70 a3 16 a8 6c d4 86 05 a8 33 f0 16 5c 7c 1f c2 f5 52 a1 1a 33 6e d8 71 87 c9 a7 5f aa ca e0 ee bb c7 50 4a 61 33 4b dd b5 a2 c4 f4 71 7c 96 1b 43 c9 47 50 7c 8c 43 55 03 a4 68 ac 26 80 47 7f 44 5b 00 7f ed a5 19 f1 af 26 f0 50 82 46 04 08 ec c8 3b 4e fc 55 ea 7e ad 8e 80 f8 dc a7 b9 5c 1b 4b e9 31 e3 f7 01 af d2 eb f5 4b 2b e9 2b a6 1c 4c 76 c9 6c a8 c1 92 31 62 44 2a a9 17 2a eb 72 b3 7c 9d 2f d8 45 77 01 24 1a 6f 92 8d bd d4 e4 69 61 03 21 b6 7c c4 bd 6a cf 3e f5 f6 76 55 f9 8c b0 1c 05 06 95 d5 0b b7 c3 b9 85 01 79 22 e9 99 b2 3e f9 66 51 fd 72 1e 07 3d 8e 6b af c7 28 d7 87 e4 a8 fc 59 53 54 db f8 da 83 3e 7e ca 4c Data Ascii: UE6!+%2d<L!oO'1\|t0hpl3\\|R3nq_PJa3Kq\|CGP\|CUh&GD[&PF;NU~\K1K++Lvl1bD*r\|/Ew$oia!\|j>vUy">fQr=k(YST>~L
2024-10-31 13:32:37 UTC	16355	OUT	Data Raw: bd 26 53 fc 86 6b c7 1d 68 9c 7e ac 33 9c 71 52 bf 76 d5 5a c5 df 8c 8d f3 11 56 a9 2a 46 5b bc 1e 23 cb 5b cf 64 d6 b6 18 67 b3 9a a4 12 e9 2e 82 53 27 77 a5 87 17 c8 fd 2c 81 91 9b 57 ba 51 82 db d6 13 07 77 b2 51 9d f9 e6 98 a2 a4 f1 08 85 c9 ee f4 78 77 ca f3 ee 2a 7b 22 a2 21 8b b2 54 be 73 90 8f 97 59 2d e2 05 eb c5 a5 df 10 0d 4b 60 8c 21 45 d1 56 1a 39 a0 c4 bf 30 a5 49 6c e8 73 a8 c3 eb 9f 59 80 03 2e 8f 08 87 f3 ef ed 31 67 4b 5b 8e 1a 3e 03 56 ff 43 d2 32 9b b1 9b c5 85 bd ba 05 d3 ef 5c e9 29 a7 71 30 09 28 cb e1 d8 04 0f 7d 9f fa c3 26 74 b8 a7 06 48 ee e1 11 92 38 62 e2 58 37 0f ce ea d6 51 91 18 cf 56 e1 2b 0d 0f 9d 2d 0d 2b 15 da c6 8c 72 38 62 2f 18 b7 28 c6 ca d8 c7 91 0b 7c a1 ca 3f 03 c1 28 19 45 e7 51 cd bb ae 76 5b 34 38 90 6e 95 99 Data Ascii: &Skh~3qRvZVF[#[dg.S'w,WQwQxw{"!TsY-K`!EV90IlsY.1gK[>VC2\)q0(}&tH8bX7QV+-+r8b/(\|?(EQv[48n
2024-10-31 13:32:37 UTC	16355	OUT	Data Raw: d8 0d 5e 57 1e 29 25 b4 fb 7b 5f 75 b1 5a 60 95 15 62 d6 62 4d 8f b1 8e 4c 30 ca 27 4f 96 ec c4 8b ff 74 fd fa 57 2d 86 d4 ef 4b 2d 35 50 9c 8f 39 24 2c fa ff c8 ab 5b a1 1a 78 28 17 aa 67 21 81 39 80 28 fb 26 df 4e 21 ff cc 0d ce 18 cc 56 12 e2 0d 49 38 eb 61 a1 4d f3 09 41 3e 1f 7c d7 64 c1 b6 8d fb 39 ab 43 67 e1 e8 11 3c 61 08 4b 94 92 44 22 fb c7 18 48 5a b0 f2 19 88 73 8a de 7d 61 67 01 de fb 8f d8 a8 84 73 fd 51 de 04 2b b0 a8 93 f0 4b 49 3a 3f ff 0f ca 83 c9 c7 f0 72 27 d0 90 aa da b7 d2 c4 dc cc 9e be cf f7 d4 c4 ee 64 b6 a4 8a e0 7c ba a1 45 f2 23 d1 74 79 3e e5 66 04 a3 e8 0d ec cb ee 4d 20 53 1d 81 c9 cb 2e 22 78 d3 4f 86 7d d2 4b 79 82 d1 fb 8b 3b 77 a1 bf ce ac 91 0c 87 e1 89 24 62 9c a2 6b 4c 2a d2 0b cf da ad d3 19 78 c8 52 98 e1 e6 0a 48 Data Ascii: ^W)%{_uZ`bbML0'OtW-K-5P9$,[x(g!9(&N!VI8aMA>\|d9Cg<aKD"HZs}agsQ+KI:?r'd\|E#ty>fM S."xO}Ky;w$bkL*xRH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49717	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:32:38 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:32:38 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:32:38 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:32:37 GMT Connection: close Content-Length: 24
2024-10-31 13:32:38 UTC	24	IN	Data Raw: 49 4d 6f 33 47 67 38 53 56 37 36 6d 46 5a 63 33 4a 62 78 2f 31 51 3d 3d Data Ascii: IMo3Gg8SV76mFZc3Jbx/1Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49734	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:32:41 UTC	326	OUT	POST /upload HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 697244 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:32:41 UTC	16355	OUT	Data Raw: 10 03 00 00 31 16 b5 04 90 a3 0a 00 e1 05 ef 78 8d 71 38 fc b4 07 e1 71 da a6 01 b1 b0 af a5 f0 9a ec ef 34 2a 00 5b 39 7f 3b 47 c4 e1 31 bd 21 da 44 da 0e 7a d4 b4 b6 75 99 e7 d6 fd d3 85 7a 05 0d dc 40 67 ad dc a7 05 46 18 64 52 d7 19 20 49 a6 8e 49 b7 5f 50 71 47 a7 86 18 1d aa fe 4e 12 0c f2 08 73 25 1f cb 35 5c 0c 1e a7 46 87 da 4b 05 73 b5 53 31 39 92 c0 b1 e0 f4 3b 7c 03 7c a1 f8 77 cd 44 2a 80 a5 56 ee 42 cf 73 c4 c5 88 ff 20 74 9b 5a 0f b1 4f d2 1f 52 c0 da ee e6 b9 5d 1b c2 ed ba 10 d8 fd ee ad db 7d 50 bc 78 1d 99 99 43 95 f4 64 77 55 65 ed 85 34 1d f5 ce 02 2e 61 ab 9e 73 da 24 b3 d7 28 bc ca e3 65 6d f6 38 6a a4 1f 61 29 d8 ac 49 f9 28 0c e8 45 04 63 8f 10 de 33 69 ec c7 71 70 72 51 7d 12 98 14 88 68 d0 62 02 2a 5c 67 78 34 b5 a2 d9 5a af 98 Data Ascii: 1xq8q4[9;G1!Dzuz@gFdR II_PqGNs%5\FKsS19;\|\|wDVBs tZOR]}PxCdwUe4.as$(em8ja)I(Ec3iqprQ}hb*\gx4Z
2024-10-31 13:32:41 UTC	16355	OUT	Data Raw: 6a 01 3a 7f 47 bb ba 4e 2a 2d 65 8e 93 67 76 dc c4 b6 73 11 54 d6 f5 fd 0c ea a4 1e 6f 6c 6e 6d e0 b6 22 f8 33 34 6e 7d 05 12 10 53 5b 8a d2 71 1e 23 9a eb 40 bd 24 fd 0f e5 0c 47 12 b0 7a 63 2a 7a d4 df 08 11 9c 73 ed 0e 00 1a 0d c9 cf f0 95 7c fb 96 e4 6a de bd 6c 10 fe 89 c5 4e a1 73 60 51 15 04 a8 e0 68 b8 5a 1f 54 5b 89 b0 6b db 33 e3 47 9a d7 55 45 fd 64 48 e6 0a 23 2a a9 7d f2 f7 56 b4 91 59 38 ab 67 40 1a d1 f9 53 68 e0 6e aa 4a 50 ee 25 d7 74 a6 de 70 a8 c7 ea dc 8f cc 91 5b 7f 67 76 84 30 00 a9 8f b5 b9 ec 04 29 b6 d1 92 7c c4 2d 38 ed 26 3a 3d 5f 66 95 9b aa f8 1c d2 1a a9 b1 07 91 d3 af b4 f2 1f a9 7c 37 e8 a7 c0 12 fa 95 b2 c8 e2 e9 e3 59 f2 b0 a6 fa 44 f6 43 be ed 53 f8 56 32 f6 c0 83 48 20 43 b8 2d d0 67 6e d2 63 af c2 cb d8 1f 1b d2 3f 7b Data Ascii: j:GN-egvsTolnm"34n}S[q#@$Gzczs\|jlNs`QhZT[k3GUEdH#*}VY8g@ShnJP%tp[gv0)\|-8&:=_f\|7YDCSV2H C-gnc?{
2024-10-31 13:32:41 UTC	16355	OUT	Data Raw: 5a 5a eb 47 b7 82 a2 f0 74 4f cd f5 85 7e 6b a1 14 a4 dd d4 ac 34 88 ee 93 55 3f 02 8e 19 03 45 4e 55 30 33 8f 95 d8 11 fa 64 68 da 10 b7 03 ce 79 b4 9e 35 0b 42 2a af 52 3a a8 68 40 1d 23 4a 5b d3 2d 48 b6 be 93 45 a7 f6 6a 83 7b 82 35 db b6 2f e2 cd a8 79 2d d3 ce 8a b1 be 64 20 24 6a 91 0c 44 d4 92 22 18 75 ea 7f ad 24 43 f2 71 3c 59 c2 b7 8a b3 14 4b af 0e c1 7f 38 7b 17 b2 7f 6c 96 28 d7 89 cb 90 d3 3e 42 71 52 d5 5f 88 32 5b 50 a5 c7 d3 b1 4c c8 49 44 b1 6f f3 25 0f 21 aa 22 35 e3 03 a6 2b db 49 15 e6 e9 ce 16 53 c0 fc 35 15 07 c2 a2 57 4c 35 38 4a c5 df aa 4e 0d 48 4b 38 6d d1 93 3a 38 26 49 29 c5 d0 4f 92 2a a8 24 c3 cc 0e 9c 2b 05 86 15 8d 67 98 9a 43 bb 06 a8 76 2b a8 fd 8c 51 b3 00 db d6 d9 fb bc 77 40 eb 02 36 69 36 43 1a 65 d7 97 f5 a2 53 8d Data Ascii: ZZGtO~k4U?ENU03dhy5BR:h@#J[-HEj{5/y-d $jD"u$Cq<YK8{l(>BqR_2[PLIDo%!"5+IS5WL58JNHK8m:8&I)O$+gCv+Qw@6i6CeS
2024-10-31 13:32:41 UTC	16355	OUT	Data Raw: b6 7a 94 77 91 f0 5f 1b 11 94 05 85 12 83 6f 33 af 4b 42 71 5a d5 07 48 fd cd 07 31 d5 45 55 5e 37 2a d9 ad 39 75 b2 d8 7a 5a 20 67 70 b7 00 20 19 32 c7 6e 96 5b 08 40 f1 22 79 d1 01 53 5a d4 12 1a cd 03 d9 dc 2b c3 6d 60 0c b0 5c dc 1d 91 6a e7 a1 98 bd b6 45 1d 59 3d b8 4b 58 68 bb 41 0c 51 88 f9 2c 9d 1d 1d 62 e1 d5 dc 05 c1 59 13 d1 f6 21 40 76 97 3e 4b 60 87 ef f9 1c 06 a7 20 2a 2e 2b 29 5e db a6 22 92 6c 41 70 a8 86 0a b9 7c 36 ca e4 99 13 79 f3 72 4b 07 5b 5c cc 87 f0 18 1b c7 78 8b 68 2c 88 39 b4 fd 95 3e 85 98 a7 fe 32 4e e7 b4 46 a0 f0 bd 27 da 1b 8e c8 82 7d 27 fc 83 34 a8 63 cb be 7f 6d 31 c9 d7 66 1b 75 89 9d ef fb 75 3e c4 37 27 1e 39 13 fb 31 02 b0 5d bf 8f d9 0b 26 55 35 ea 6b 13 46 c5 3b ee ef df bb 74 80 a6 fd 85 09 d8 e4 1d ae 2a 6b 97 Data Ascii: zw_o3KBqZH1EU^79uzZ gp 2n[@"ySZ+m`\jEY=KXhAQ,bY!@v>K` .+)^"lAp\|6yrK[\xh,9>2NF'}'4cm1fuu>7'91]&U5kF;t*k
2024-10-31 13:32:41 UTC	16355	OUT	Data Raw: 6c b7 99 28 2e 6c 69 2f ee 3d 92 82 e2 20 13 ad 96 fb 86 c4 e2 53 45 38 42 b4 0a a1 18 c6 c7 7d dc 11 e4 dc b6 1b 72 10 37 fe 88 2c 1a b9 b2 8d 9a 87 47 79 a2 7d 5f 95 91 ac 93 7c 9f 5a e0 c6 91 a5 65 39 7c ef e3 22 71 95 14 9d 7a 39 b8 76 ea f4 bb 3a 20 fc 6f 6c b4 6e c3 7d 32 e7 6b 2e e5 0c f6 5e a6 31 ad 0b 44 70 4c 3f 5f 23 85 ae e2 8b 46 e9 94 e0 f1 a0 b8 43 db 8d ee e7 a0 a8 dd 8a ab 2f d9 92 1e 07 28 33 89 87 39 36 89 90 a2 3a 5d df 1f e7 2a 5b ec 67 a5 44 b1 bf fd b1 a1 ad b0 a7 fb ef c1 86 1e be 0e 79 c1 91 54 08 a8 fc 57 06 53 86 13 0e cd f7 6e 65 e8 88 c8 14 9e de 6c 93 77 be 9b da 02 dc da 12 67 ab 00 62 78 3f 00 46 c7 56 b9 a5 82 de 91 75 d9 91 e4 1e 9c 21 aa bf 85 e9 69 38 96 c1 14 84 c8 8f 7a b9 e1 ca ec 3e 77 1d 07 8a 48 ce ca 62 96 49 94 Data Ascii: l(.li/= SE8B}r7,Gy}_\|Ze9\|"qz9v: oln}2k.^1DpL?_#FC/(396:]*[gDyTWSnelwgbx?FVu!i8z>wHbI
2024-10-31 13:32:41 UTC	16355	OUT	Data Raw: 37 53 30 9f 5c 69 ad 41 00 49 eb 0d 58 10 da c0 af 72 8c dd 23 1f 62 35 b2 49 c4 c9 2d b9 f5 72 36 32 98 f7 d1 45 b9 6a e4 41 96 1b bf f4 88 da b9 61 17 13 37 8e 2a 82 b3 59 73 eb 18 eb 72 3f 01 86 2f 2e ea a1 fc 51 93 4f a1 6f 47 53 49 1e ac 6b 62 76 7f 5d a9 ad 2e b1 1a 3f a1 57 e4 4c 38 ba 06 8e 32 49 7b c8 0f 2a c9 16 67 de e6 32 7a 6b 8b bd 16 b0 40 35 56 18 b0 aa 1a 30 ad 0f 77 79 24 ef bb d1 30 4b 21 f0 e0 66 af 2c ba 6c a0 e6 51 8a aa 22 65 59 99 9c fc d2 f1 5e 3a f3 ab 97 87 30 30 dc 4f 33 e1 e5 e6 d5 23 5a 1f 56 f8 78 a3 04 23 cb 51 f0 8e 5a d3 17 25 93 a4 0e 0f 50 d3 42 17 5d aa be 57 54 91 04 5f b3 a1 f1 fb 59 86 30 f0 7e 0b 89 fe c5 ef 3e 42 c8 1b 86 fd dc 43 5f 38 bc 39 16 f1 06 ce ae e2 15 2c 26 ea 5b 98 f7 20 2e cc ac 37 5d 41 56 f5 91 63 Data Ascii: 7S0\iAIXr#b5I-r62EjAa7Ysr?/.QOoGSIkbv].?WL82I{g2zk@5V0wy$0K!f,lQ"eY^:00O3#ZVx#QZ%PB]WT_Y0~>BC_89,&[ .7]AVc
2024-10-31 13:32:41 UTC	16355	OUT	Data Raw: 84 bb 0a 75 a4 76 69 02 7c f8 89 ce c2 67 22 4f 65 1c d7 3c 4e e3 61 78 9a fe 5d 46 88 bb 31 58 77 21 3c e7 ed c6 3f 5f 73 10 db 72 25 d9 20 4f d2 a2 59 ac 4e 91 03 93 d4 ea 77 4f be 75 28 fd a5 16 bd bd 71 0d 59 af 31 97 fc e5 d2 9c 37 6f 99 2b b5 04 6e bd ad e0 b2 bd d3 3b 29 e9 cd 48 2c fe bc 4c b2 f9 90 f1 a8 15 c7 b5 80 f2 b4 f7 77 d9 76 6a 85 70 ff 22 e5 e4 8a 36 ec 59 3c 6d 17 a6 e2 ab 4d 64 fa 56 52 b3 6a e3 e1 e6 a0 99 18 f5 3d 33 96 d1 a6 11 ad a9 65 39 12 34 0e a4 74 67 59 9b 7b 97 9f ab e1 2b 48 5b ae 5d ca b7 56 6c d2 2e 5a 88 7c 2f bc 1c 90 4b d0 af 73 5c c2 20 e4 25 9e 32 5a 27 c2 22 57 1a 65 05 1e 6b 97 8a b8 e1 e4 64 12 a8 87 a7 94 f2 6f 4f 44 de 49 7a 36 13 22 7d 59 89 85 d3 c1 5d 7b 47 5a 9c 2c af 26 b0 dd 68 c5 59 8f 56 20 f4 1b ff d0 Data Ascii: uvi\|g"Oe<Nax]F1Xw!<?_sr% OYNwOu(qY17o+n;)H,Lwvjp"6Y<mMdVRj=3e94tgY{+H[]Vl.Z\|/Ks\ %2Z'"WekdoODIz6"}Y]{GZ,&hYV
2024-10-31 13:32:41 UTC	16355	OUT	Data Raw: b9 55 c6 ef 93 c3 0a 45 8a 36 19 21 f4 2b 25 ae 19 32 2a 64 3c e1 bc e8 4c f3 cc 9a 21 bf 83 6f d2 4f b0 27 31 e3 7c 74 30 e8 68 d6 da 86 70 a3 16 a8 6c d4 86 05 a8 33 f0 16 5c 7c 1f c2 f5 52 a1 1a 33 6e d8 71 87 c9 a7 5f aa ca e0 ee bb c7 50 4a 61 33 4b dd b5 a2 c4 f4 71 7c 96 1b 43 c9 47 50 7c 8c 43 55 03 a4 68 ac 26 80 47 7f 44 5b 00 7f ed a5 19 f1 af 26 f0 50 82 46 04 08 ec c8 3b 4e fc 55 ea 7e ad 8e 80 f8 dc a7 b9 5c 1b 4b e9 31 e3 f7 01 af d2 eb f5 4b 2b e9 2b a6 1c 4c 76 c9 6c a8 c1 92 31 62 44 2a a9 17 2a eb 72 b3 7c 9d 2f d8 45 77 01 24 1a 6f 92 8d bd d4 e4 69 61 03 21 b6 7c c4 bd 6a cf 3e f5 f6 76 55 f9 8c b0 1c 05 06 95 d5 0b b7 c3 b9 85 01 79 22 e9 99 b2 3e f9 66 51 fd 72 1e 07 3d 8e 6b af c7 28 d7 87 e4 a8 fc 59 53 54 db f8 da 83 3e 7e ca 4c Data Ascii: UE6!+%2d<L!oO'1\|t0hpl3\\|R3nq_PJa3Kq\|CGP\|CUh&GD[&PF;NU~\K1K++Lvl1bD*r\|/Ew$oia!\|j>vUy">fQr=k(YST>~L
2024-10-31 13:32:41 UTC	16355	OUT	Data Raw: bd 26 53 fc 86 6b c7 1d 68 9c 7e ac 33 9c 71 52 bf 76 d5 5a c5 df 8c 8d f3 11 56 a9 2a 46 5b bc 1e 23 cb 5b cf 64 d6 b6 18 67 b3 9a a4 12 e9 2e 82 53 27 77 a5 87 17 c8 fd 2c 81 91 9b 57 ba 51 82 db d6 13 07 77 b2 51 9d f9 e6 98 a2 a4 f1 08 85 c9 ee f4 78 77 ca f3 ee 2a 7b 22 a2 21 8b b2 54 be 73 90 8f 97 59 2d e2 05 eb c5 a5 df 10 0d 4b 60 8c 21 45 d1 56 1a 39 a0 c4 bf 30 a5 49 6c e8 73 a8 c3 eb 9f 59 80 03 2e 8f 08 87 f3 ef ed 31 67 4b 5b 8e 1a 3e 03 56 ff 43 d2 32 9b b1 9b c5 85 bd ba 05 d3 ef 5c e9 29 a7 71 30 09 28 cb e1 d8 04 0f 7d 9f fa c3 26 74 b8 a7 06 48 ee e1 11 92 38 62 e2 58 37 0f ce ea d6 51 91 18 cf 56 e1 2b 0d 0f 9d 2d 0d 2b 15 da c6 8c 72 38 62 2f 18 b7 28 c6 ca d8 c7 91 0b 7c a1 ca 3f 03 c1 28 19 45 e7 51 cd bb ae 76 5b 34 38 90 6e 95 99 Data Ascii: &Skh~3qRvZVF[#[dg.S'w,WQwQxw{"!TsY-K`!EV90IlsY.1gK[>VC2\)q0(}&tH8bX7QV+-+r8b/(\|?(EQv[48n
2024-10-31 13:32:41 UTC	16355	OUT	Data Raw: d8 0d 5e 57 1e 29 25 b4 fb 7b 5f 75 b1 5a 60 95 15 62 d6 62 4d 8f b1 8e 4c 30 ca 27 4f 96 ec c4 8b ff 74 fd fa 57 2d 86 d4 ef 4b 2d 35 50 9c 8f 39 24 2c fa ff c8 ab 5b a1 1a 78 28 17 aa 67 21 81 39 80 28 fb 26 df 4e 21 ff cc 0d ce 18 cc 56 12 e2 0d 49 38 eb 61 a1 4d f3 09 41 3e 1f 7c d7 64 c1 b6 8d fb 39 ab 43 67 e1 e8 11 3c 61 08 4b 94 92 44 22 fb c7 18 48 5a b0 f2 19 88 73 8a de 7d 61 67 01 de fb 8f d8 a8 84 73 fd 51 de 04 2b b0 a8 93 f0 4b 49 3a 3f ff 0f ca 83 c9 c7 f0 72 27 d0 90 aa da b7 d2 c4 dc cc 9e be cf f7 d4 c4 ee 64 b6 a4 8a e0 7c ba a1 45 f2 23 d1 74 79 3e e5 66 04 a3 e8 0d ec cb ee 4d 20 53 1d 81 c9 cb 2e 22 78 d3 4f 86 7d d2 4b 79 82 d1 fb 8b 3b 77 a1 bf ce ac 91 0c 87 e1 89 24 62 9c a2 6b 4c 2a d2 0b cf da ad d3 19 78 c8 52 98 e1 e6 0a 48 Data Ascii: ^W)%{_uZ`bbML0'OtW-K-5P9$,[x(g!9(&N!VI8aMA>\|d9Cg<aKD"HZs}agsQ+KI:?r'd\|E#ty>fM S."xO}Ky;w$bkL*xRH
2024-10-31 13:32:42 UTC	162	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:32:41 GMT Connection: close Content-Length: 7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49771	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:32:47 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:32:47 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:32:47 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:32:47 GMT Connection: close Content-Length: 24
2024-10-31 13:32:47 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49807	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:32:53 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:32:53 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:32:54 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:32:54 GMT Connection: close Content-Length: 24
2024-10-31 13:32:54 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49835	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:32:58 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:32:58 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:32:59 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:32:59 GMT Connection: close Content-Length: 24
2024-10-31 13:32:59 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49865	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:03 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:03 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:04 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:03 GMT Connection: close Content-Length: 24
2024-10-31 13:33:04 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49901	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:10 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:10 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:10 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:10 GMT Connection: close Content-Length: 24
2024-10-31 13:33:10 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49932	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:15 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:15 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:16 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:15 GMT Connection: close Content-Length: 24
2024-10-31 13:33:16 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49961	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:20 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:20 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:20 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:20 GMT Connection: close Content-Length: 24
2024-10-31 13:33:20 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49997	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:27 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:27 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:27 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:27 GMT Connection: close Content-Length: 24
2024-10-31 13:33:27 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49999	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:33 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:33 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:34 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:33 GMT Connection: close Content-Length: 24
2024-10-31 13:33:34 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50000	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:39 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:39 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:39 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:38 GMT Connection: close Content-Length: 24
2024-10-31 13:33:39 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	50002	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:44 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:44 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:44 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:44 GMT Connection: close Content-Length: 24
2024-10-31 13:33:44 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	50003	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:49 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:49 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:50 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:50 GMT Connection: close Content-Length: 24
2024-10-31 13:33:50 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	50004	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:54 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:54 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:54 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:54 GMT Connection: close Content-Length: 24
2024-10-31 13:33:54 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	50005	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:33:59 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:33:59 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:33:59 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:33:59 GMT Connection: close Content-Length: 24
2024-10-31 13:33:59 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	50006	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:34:04 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:34:04 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:34:04 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:34:04 GMT Connection: close Content-Length: 24
2024-10-31 13:34:04 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	50007	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:34:09 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:34:09 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:34:09 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:34:08 GMT Connection: close Content-Length: 24
2024-10-31 13:34:09 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50008	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:34:14 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:34:14 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:34:14 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:34:14 GMT Connection: close Content-Length: 24
2024-10-31 13:34:14 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50009	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:34:20 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:34:20 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:34:21 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:34:20 GMT Connection: close Content-Length: 24
2024-10-31 13:34:21 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50010	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:34:27 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:34:27 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:34:27 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:34:27 GMT Connection: close Content-Length: 24
2024-10-31 13:34:27 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50011	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:34:33 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:34:33 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:34:34 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:34:33 GMT Connection: close Content-Length: 24
2024-10-31 13:34:34 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50012	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:34:38 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:34:38 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:34:39 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:34:38 GMT Connection: close Content-Length: 24
2024-10-31 13:34:39 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	50013	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:34:45 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:34:45 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:34:45 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:34:45 GMT Connection: close Content-Length: 24
2024-10-31 13:34:45 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50014	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:34:51 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:34:51 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:34:52 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:34:52 GMT Connection: close Content-Length: 24
2024-10-31 13:34:52 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50015	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:34:56 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:34:56 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:34:57 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:34:57 GMT Connection: close Content-Length: 24
2024-10-31 13:34:57 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	50016	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:35:01 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:35:01 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:35:02 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:35:02 GMT Connection: close Content-Length: 24
2024-10-31 13:35:02 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50017	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:35:06 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:35:06 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:35:07 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:35:07 GMT Connection: close Content-Length: 24
2024-10-31 13:35:07 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50018	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:35:12 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:35:12 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:35:12 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:35:12 GMT Connection: close Content-Length: 24
2024-10-31 13:35:12 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50019	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:35:18 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:35:18 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:35:18 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:35:18 GMT Connection: close Content-Length: 24
2024-10-31 13:35:18 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50020	89.221.225.227	443	3688	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 13:35:24 UTC	323	OUT	POST /register HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-CH User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: vacationtogotravels.net Content-Length: 8 Connection: Keep-Alive Cache-Control: no-cache
2024-10-31 13:35:24 UTC	8	OUT	Data Raw: 8d 6b 95 2f 10 03 00 00 Data Ascii: k/
2024-10-31 13:35:24 UTC	163	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 Date: Thu, 31 Oct 2024 13:35:24 GMT Connection: close Content-Length: 24
2024-10-31 13:35:24 UTC	24	IN	Data Raw: 2f 54 42 47 35 76 7a 68 35 72 37 59 37 48 71 75 4e 56 4c 4c 30 67 3d 3d Data Ascii: /TBG5vzh5r7Y7HquNVLL0g==

Target ID:	0
Start time:	09:32:17
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\U6ghPv3E7k.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\U6ghPv3E7k.exe"
Imagebase:	0x7ff710d40000
File size:	576'000 bytes
MD5 hash:	00BA1E1D154E18D1124D87934FAE9F20
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:32:17
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:32:28
Start date:	31/10/2024
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
Imagebase:	0x7ff70fac0000
File size:	834'512 bytes
MD5 hash:	CFE2E6942AC1B72981B3105E22D3224E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:32:28
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5532 CREDAT:17410 /prefetch:2
Imagebase:	0x2e0000
File size:	828'368 bytes
MD5 hash:	6F0F06D6AB125A99E43335427066A4A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	09:32:28
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe
Wow64 process (32bit):	true
Commandline:	"C:\PROGRA~2\Java\jre-1.8\bin\ssvagent.exe" -new
Imagebase:	0xca0000
File size:	85'632 bytes
MD5 hash:	F9A898A606E7F5A1CD7CFFA8079253A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report U6ghPv3E7k.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{92095A5E-978C-11EF-8C2C-ECF4BB570DC9}.dat

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{92095A60-978C-11EF-8C2C-ECF4BB570DC9}.dat

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\m1niz3t\imagestore.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\uploadfcba94a8[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\favicon[1].ico

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\registerbb130302[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\registerbb130302[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\favicon[1].ico

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\register[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\registerbb130302[1].htm

C:\Users\user\AppData\Local\Temp\~DF3233F130AB51BE21.TMP

C:\Users\user\AppData\Local\Temp\~DF4C4ABBEFBEE1C868.TMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms~RF510d0.TMP (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M925D3GEDGLRFZX1LVWS.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SB4AAY81SXRWD1OOVZ5Z.temp

\Device\ConDrv

Windows Analysis Report
U6ghPv3E7k.exe