Edit tour

Windows Analysis Report
MWP0FO5rAF.exe

Overview

General Information

Sample name:	MWP0FO5rAF.exe renamed because original name is a hash value
Original sample name:	f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe
Analysis ID:	1587871
MD5:	79e059e518b08adbf428180b3e05495e
SHA1:	53dec3a16758aeb96a1afce4245b26c56d53d40a
SHA256:	f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Classification

Process Tree

System is w10x64

MWP0FO5rAF.exe (PID: 7596 cmdline: "C:\Users\user\Desktop\MWP0FO5rAF.exe" MD5: 79E059E518B08ADBF428180B3E05495E)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
MWP0FO5rAF.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.MWP0FO5rAF.exe.370000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:56:45.262942+0100	2803305	3	Unknown Traffic	192.168.2.9	49756	194.15.112.248	443	TCP
2025-01-10T18:56:47.750226+0100	2803305	3	Unknown Traffic	192.168.2.9	49768	194.15.112.248	443	TCP
2025-01-10T18:56:49.563677+0100	2803305	3	Unknown Traffic	192.168.2.9	49782	194.15.112.248	443	TCP
2025-01-10T18:56:51.472596+0100	2803305	3	Unknown Traffic	192.168.2.9	49793	194.15.112.248	443	TCP
2025-01-10T18:56:54.066444+0100	2803305	3	Unknown Traffic	192.168.2.9	49804	194.15.112.248	443	TCP
2025-01-10T18:57:04.976537+0100	2803305	3	Unknown Traffic	192.168.2.9	49818	194.15.112.248	443	TCP
2025-01-10T18:57:07.198274+0100	2803305	3	Unknown Traffic	192.168.2.9	49870	194.15.112.248	443	TCP
2025-01-10T18:57:09.070685+0100	2803305	3	Unknown Traffic	192.168.2.9	49882	194.15.112.248	443	TCP
2025-01-10T18:57:14.387559+0100	2803305	3	Unknown Traffic	192.168.2.9	49890	194.15.112.248	443	TCP
2025-01-10T18:57:16.475156+0100	2803305	3	Unknown Traffic	192.168.2.9	49918	194.15.112.248	443	TCP
2025-01-10T18:57:18.321316+0100	2803305	3	Unknown Traffic	192.168.2.9	49929	194.15.112.248	443	TCP
2025-01-10T18:57:20.678591+0100	2803305	3	Unknown Traffic	192.168.2.9	49940	194.15.112.248	443	TCP
2025-01-10T18:57:23.008507+0100	2803305	3	Unknown Traffic	192.168.2.9	49956	194.15.112.248	443	TCP
2025-01-10T18:57:26.260261+0100	2803305	3	Unknown Traffic	192.168.2.9	49969	194.15.112.248	443	TCP
2025-01-10T18:57:28.212441+0100	2803305	3	Unknown Traffic	192.168.2.9	49987	194.15.112.248	443	TCP
2025-01-10T18:57:30.055033+0100	2803305	3	Unknown Traffic	192.168.2.9	49994	194.15.112.248	443	TCP
2025-01-10T18:57:31.880936+0100	2803305	3	Unknown Traffic	192.168.2.9	49995	194.15.112.248	443	TCP
2025-01-10T18:57:33.707657+0100	2803305	3	Unknown Traffic	192.168.2.9	49996	194.15.112.248	443	TCP
2025-01-10T18:57:35.545267+0100	2803305	3	Unknown Traffic	192.168.2.9	49998	194.15.112.248	443	TCP
2025-01-10T18:57:37.368038+0100	2803305	3	Unknown Traffic	192.168.2.9	49999	194.15.112.248	443	TCP
2025-01-10T18:57:39.204465+0100	2803305	3	Unknown Traffic	192.168.2.9	50000	194.15.112.248	443	TCP
2025-01-10T18:57:41.155816+0100	2803305	3	Unknown Traffic	192.168.2.9	50001	194.15.112.248	443	TCP
2025-01-10T18:57:42.991357+0100	2803305	3	Unknown Traffic	192.168.2.9	50002	194.15.112.248	443	TCP
2025-01-10T18:57:47.943872+0100	2803305	3	Unknown Traffic	192.168.2.9	50003	194.15.112.248	443	TCP
2025-01-10T18:57:49.763923+0100	2803305	3	Unknown Traffic	192.168.2.9	50004	194.15.112.248	443	TCP
2025-01-10T18:57:51.709021+0100	2803305	3	Unknown Traffic	192.168.2.9	50005	194.15.112.248	443	TCP
2025-01-10T18:57:54.004270+0100	2803305	3	Unknown Traffic	192.168.2.9	50006	194.15.112.248	443	TCP
2025-01-10T18:57:56.279079+0100	2803305	3	Unknown Traffic	192.168.2.9	50007	194.15.112.248	443	TCP
2025-01-10T18:57:58.182221+0100	2803305	3	Unknown Traffic	192.168.2.9	50008	194.15.112.248	443	TCP
2025-01-10T18:58:03.357723+0100	2803305	3	Unknown Traffic	192.168.2.9	50009	194.15.112.248	443	TCP
2025-01-10T18:58:05.352484+0100	2803305	3	Unknown Traffic	192.168.2.9	50010	194.15.112.248	443	TCP
2025-01-10T18:58:08.400228+0100	2803305	3	Unknown Traffic	192.168.2.9	50011	194.15.112.248	443	TCP
2025-01-10T18:58:11.363145+0100	2803305	3	Unknown Traffic	192.168.2.9	50012	194.15.112.248	443	TCP
2025-01-10T18:58:13.298190+0100	2803305	3	Unknown Traffic	192.168.2.9	50013	194.15.112.248	443	TCP
2025-01-10T18:58:15.369583+0100	2803305	3	Unknown Traffic	192.168.2.9	50014	194.15.112.248	443	TCP
2025-01-10T18:58:17.259067+0100	2803305	3	Unknown Traffic	192.168.2.9	50015	194.15.112.248	443	TCP
2025-01-10T18:58:19.820500+0100	2803305	3	Unknown Traffic	192.168.2.9	50016	194.15.112.248	443	TCP
2025-01-10T18:58:21.892570+0100	2803305	3	Unknown Traffic	192.168.2.9	50017	194.15.112.248	443	TCP
2025-01-10T18:58:23.831966+0100	2803305	3	Unknown Traffic	192.168.2.9	50018	194.15.112.248	443	TCP
2025-01-10T18:58:26.700254+0100	2803305	3	Unknown Traffic	192.168.2.9	50019	194.15.112.248	443	TCP
2025-01-10T18:58:28.806028+0100	2803305	3	Unknown Traffic	192.168.2.9	50020	194.15.112.248	443	TCP
2025-01-10T18:58:30.761381+0100	2803305	3	Unknown Traffic	192.168.2.9	50021	194.15.112.248	443	TCP
2025-01-10T18:58:35.672634+0100	2803305	3	Unknown Traffic	192.168.2.9	50022	194.15.112.248	443	TCP
2025-01-10T18:58:37.672175+0100	2803305	3	Unknown Traffic	192.168.2.9	50023	194.15.112.248	443	TCP
2025-01-10T18:58:40.462595+0100	2803305	3	Unknown Traffic	192.168.2.9	50024	194.15.112.248	443	TCP
2025-01-10T18:58:42.473049+0100	2803305	3	Unknown Traffic	192.168.2.9	50025	194.15.112.248	443	TCP
2025-01-10T18:58:44.761698+0100	2803305	3	Unknown Traffic	192.168.2.9	50026	194.15.112.248	443	TCP
2025-01-10T18:58:46.559473+0100	2803305	3	Unknown Traffic	192.168.2.9	50027	194.15.112.248	443	TCP
2025-01-10T18:58:48.936705+0100	2803305	3	Unknown Traffic	192.168.2.9	50028	194.15.112.248	443	TCP
2025-01-10T18:58:51.239069+0100	2803305	3	Unknown Traffic	192.168.2.9	50029	194.15.112.248	443	TCP
2025-01-10T18:58:52.997735+0100	2803305	3	Unknown Traffic	192.168.2.9	50030	194.15.112.248	443	TCP
2025-01-10T18:58:54.802096+0100	2803305	3	Unknown Traffic	192.168.2.9	50031	194.15.112.248	443	TCP
2025-01-10T18:58:56.547736+0100	2803305	3	Unknown Traffic	192.168.2.9	50032	194.15.112.248	443	TCP
2025-01-10T18:58:59.233948+0100	2803305	3	Unknown Traffic	192.168.2.9	50033	194.15.112.248	443	TCP
2025-01-10T18:59:01.075346+0100	2803305	3	Unknown Traffic	192.168.2.9	50034	194.15.112.248	443	TCP
2025-01-10T18:59:04.968882+0100	2803305	3	Unknown Traffic	192.168.2.9	50035	194.15.112.248	443	TCP
2025-01-10T18:59:06.742406+0100	2803305	3	Unknown Traffic	192.168.2.9	50036	194.15.112.248	443	TCP
2025-01-10T18:59:08.519975+0100	2803305	3	Unknown Traffic	192.168.2.9	50037	194.15.112.248	443	TCP
2025-01-10T18:59:10.285871+0100	2803305	3	Unknown Traffic	192.168.2.9	50038	194.15.112.248	443	TCP
2025-01-10T18:59:15.112614+0100	2803305	3	Unknown Traffic	192.168.2.9	50039	194.15.112.248	443	TCP
2025-01-10T18:59:16.869776+0100	2803305	3	Unknown Traffic	192.168.2.9	50040	194.15.112.248	443	TCP
2025-01-10T18:59:18.744880+0100	2803305	3	Unknown Traffic	192.168.2.9	50041	194.15.112.248	443	TCP
2025-01-10T18:59:20.555289+0100	2803305	3	Unknown Traffic	192.168.2.9	50042	194.15.112.248	443	TCP
2025-01-10T18:59:22.282448+0100	2803305	3	Unknown Traffic	192.168.2.9	50043	194.15.112.248	443	TCP
2025-01-10T18:59:24.055772+0100	2803305	3	Unknown Traffic	192.168.2.9	50044	194.15.112.248	443	TCP
2025-01-10T18:59:26.034374+0100	2803305	3	Unknown Traffic	192.168.2.9	50045	194.15.112.248	443	TCP
2025-01-10T18:59:28.936967+0100	2803305	3	Unknown Traffic	192.168.2.9	50046	194.15.112.248	443	TCP
2025-01-10T18:59:30.692547+0100	2803305	3	Unknown Traffic	192.168.2.9	50047	194.15.112.248	443	TCP
2025-01-10T18:59:32.461967+0100	2803305	3	Unknown Traffic	192.168.2.9	50048	194.15.112.248	443	TCP
2025-01-10T18:59:34.373241+0100	2803305	3	Unknown Traffic	192.168.2.9	50049	194.15.112.248	443	TCP
2025-01-10T18:59:36.192047+0100	2803305	3	Unknown Traffic	192.168.2.9	50050	194.15.112.248	443	TCP
2025-01-10T18:59:38.207078+0100	2803305	3	Unknown Traffic	192.168.2.9	50051	194.15.112.248	443	TCP
2025-01-10T18:59:40.094785+0100	2803305	3	Unknown Traffic	192.168.2.9	50052	194.15.112.248	443	TCP
2025-01-10T18:59:42.129700+0100	2803305	3	Unknown Traffic	192.168.2.9	50053	194.15.112.248	443	TCP
2025-01-10T18:59:43.967484+0100	2803305	3	Unknown Traffic	192.168.2.9	50054	194.15.112.248	443	TCP
2025-01-10T18:59:45.905840+0100	2803305	3	Unknown Traffic	192.168.2.9	50055	194.15.112.248	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MWP0FO5rAF.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: MWP0FO5rAF.exe	Virustotal: Detection: 73%			Perma Link
Source: MWP0FO5rAF.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for sample

Source: MWP0FO5rAF.exe

Joe Sandbox ML: detected

Source: MWP0FO5rAF.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.9:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.9:50019 version: TLS 1.2

Source: MWP0FO5rAF.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: MWP0FO5rAF.exe, type: SAMPLE
Source: Yara match	File source: 0.0.MWP0FO5rAF.exe.370000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at

Source: Joe Sandbox View

IP Address: 194.15.112.248 194.15.112.248

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49756 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49768 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49793 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49890 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49804 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49999 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50004 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50009 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50017 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49996 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50031 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50029 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50038 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49818 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50037 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50019 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50012 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50043 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50054 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50039 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50014 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50048 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49870 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49782 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49882 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49918 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50028 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49998 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50052 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49994 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50018 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50008 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49969 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50002 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50003 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50005 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50041 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50035 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50015 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50021 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50034 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50051 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50013 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49956 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50053 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50042 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50050 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49995 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50010 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50055 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50027 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50006 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50000 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49940 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50011 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50032 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50026 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50016 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50001 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50033 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50046 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50040 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50020 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50036 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50024 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49987 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50007 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50023 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50030 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50045 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50025 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50044 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49929 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50049 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50022 -> 194.15.112.248:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50047 -> 194.15.112.248:443

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.atConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at
Source: global traffic	HTTP traffic detected: GET /gQkq HTTP/1.1Host: oshi.at

Source: global traffic

DNS traffic detected: DNS query: oshi.at

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:56:42 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:56:45 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:56:47 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:56:49 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:56:51 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:56:53 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:04 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:07 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:08 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:14 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:16 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:18 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:20 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:22 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:26 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:28 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:29 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:31 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:33 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:35 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:37 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:39 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:40 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:42 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:47 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:49 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:51 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:53 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:56 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:57:58 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:03 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:05 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:08 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:11 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:13 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:15 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:17 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:19 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:21 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:23 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:26 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:28 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:30 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:35 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:37 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:40 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:42 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:44 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:46 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:48 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:51 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:52 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:54 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:56 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:58:59 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:00 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:04 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:06 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:08 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:10 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:14 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:16 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:18 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:20 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:22 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:23 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:25 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:28 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:30 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:32 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:34 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:36 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:37 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:39 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:41 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:43 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 17:59:45 GMTContent-Type: text/html;charset=UTF-8Content-Length: 1849Connection: close

Source: MWP0FO5rAF.exe	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: MWP0FO5rAF.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: MWP0FO5rAF.exe	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: MWP0FO5rAF.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: MWP0FO5rAF.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: MWP0FO5rAF.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: MWP0FO5rAF.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: MWP0FO5rAF.exe	String found in binary or memory: http://ocsps.ssl.com0?
Source: MWP0FO5rAF.exe	String found in binary or memory: http://ocsps.ssl.com0_
Source: MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://oshi.at
Source: MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://oshi.atd
Source: MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MWP0FO5rAF.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: MWP0FO5rAF.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000029E3000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028F7000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002952000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000029CB000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002956000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000029E7000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.000000000295A000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000029FF000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BDD000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BD9000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002946000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B65000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.000000000293E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/somenonymous/OshiUpload
Source: MWP0FO5rAF.exe, 00000000.00000002.3222304799.000000000295A000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028FB000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oshi.at
Source: MWP0FO5rAF.exe	String found in binary or memory: https://oshi.at/gQkq
Source: MWP0FO5rAF.exe, 00000000.00000002.3222304799.000000000295A000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028FB000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oshi.at/gQkqd
Source: MWP0FO5rAF.exe	String found in binary or memory: https://www.ssl.com/repository0

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.9:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 194.15.112.248:443 -> 192.168.2.9:50019 version: TLS 1.2

Source: MWP0FO5rAF.exe

Static PE information: invalid certificate

Source: MWP0FO5rAF.exe, 00000000.00000002.3221776711.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs MWP0FO5rAF.exe
Source: MWP0FO5rAF.exe, 00000000.00000000.1373179471.0000000000372000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameref.exe8 vs MWP0FO5rAF.exe
Source: MWP0FO5rAF.exe	Binary or memory string: OriginalFilenameref.exe8 vs MWP0FO5rAF.exe

Source: MWP0FO5rAF.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.troj.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe

Mutant created: NULL

Source: MWP0FO5rAF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: MWP0FO5rAF.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MWP0FO5rAF.exe	Virustotal: Detection: 73%
Source: MWP0FO5rAF.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Section loaded: gpapi.dll	Jump to behavior

Source: MWP0FO5rAF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: MWP0FO5rAF.exe

Static file information: File size 1072096 > 1048576

Source: MWP0FO5rAF.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Memory allocated: BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Memory allocated: E10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe TID: 7716	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe TID: 7716	Thread sleep time: -600000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\MWP0FO5rAF.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: MWP0FO5rAF.exe, 00000000.00000002.3221776711.0000000000A92000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe

Queries volume information: C:\Users\user\Desktop\MWP0FO5rAF.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\MWP0FO5rAF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	31 Virtualization/Sandbox Evasion	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
MWP0FO5rAF.exe	74%	Virustotal		Browse
MWP0FO5rAF.exe	66%	ReversingLabs	Win32.Exploit.Generic
MWP0FO5rAF.exe	100%	Avira	HEUR/AGEN.1329692
MWP0FO5rAF.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://oshi.at/gQkq	0%	Avira URL Cloud	safe
https://oshi.at/gQkqd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
oshi.at	194.15.112.248	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://oshi.at/gQkq	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0	MWP0FO5rAF.exe	false		high
http://oshi.atd	MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crls.ssl.com/ssl.com-rsa-RootCA.crl0	MWP0FO5rAF.exe	false		high
https://oshi.at/gQkqd	MWP0FO5rAF.exe, 00000000.00000002.3222304799.000000000295A000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028FB000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0	MWP0FO5rAF.exe	false		high
http://oshi.at	MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/somenonymous/OshiUpload	MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000029E3000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028F7000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B4D000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B99000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002952000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000029CB000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002956000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000029E7000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.000000000295A000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000029FF000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BDD000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002A0F000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BD9000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002946000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002B65000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.000000000293E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ssl.com/repository0	MWP0FO5rAF.exe	false		high
http://ocsps.ssl.com0?	MWP0FO5rAF.exe	false		high
http://ocsps.ssl.com0_	MWP0FO5rAF.exe	false		high
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	MWP0FO5rAF.exe	false		high
https://oshi.at	MWP0FO5rAF.exe, 00000000.00000002.3222304799.000000000295A000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028FB000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002A2C000.00000004.00000800.00020000.00000000.sdmp, MWP0FO5rAF.exe, 00000000.00000002.3222304799.0000000002BE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q	MWP0FO5rAF.exe	false		high
http://ocsps.ssl.com0	MWP0FO5rAF.exe	false		high
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0	MWP0FO5rAF.exe	false		high
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	MWP0FO5rAF.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MWP0FO5rAF.exe, 00000000.00000002.3222304799.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0	MWP0FO5rAF.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.15.112.248	oshi.at	Ukraine		213354	INTERNATIONAL-HOSTING-SOLUTIONS-ASEUDCrouteGB	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587871
Start date and time:	2025-01-10 18:55:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MWP0FO5rAF.exe renamed because original name is a hash value
Original Sample Name:	f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe
Detection:	MAL
Classification:	mal68.troj.winEXE@1/0@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MWP0FO5rAF.exe, PID 7596 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
194.15.112.248	IMG_10503677.exe	Get hash	malicious	MassLogger RAT	Browse
	Ref#103052.exe	Get hash	malicious	XWorm	Browse
	9876567899.bat.exe	Get hash	malicious	Lokibot	Browse
	Ref_31020563.exe	Get hash	malicious	Unknown	Browse
	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse
	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
oshi.at	GhwFStoMJX.exe	Get hash	malicious	Unknown	Browse	5.253.86.15
	GhwFStoMJX.exe	Get hash	malicious	Unknown	Browse	5.253.86.15
	IMG_10503677.exe	Get hash	malicious	MassLogger RAT	Browse	194.15.112.248
	IMG_10503677.exe	Get hash	malicious	Unknown	Browse	5.253.86.15
	Holiday#3021.exe	Get hash	malicious	Unknown	Browse	5.253.86.15
	Holiday#3021.exe	Get hash	malicious	Unknown	Browse	5.253.86.15
	Ref#103052.exe	Get hash	malicious	XWorm	Browse	194.15.112.248
	Ref#103052.exe	Get hash	malicious	Unknown	Browse	5.253.86.15
	9876567899.bat.exe	Get hash	malicious	Lokibot	Browse	194.15.112.248

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
INTERNATIONAL-HOSTING-SOLUTIONS-ASEUDCrouteGB	IMG_10503677.exe	Get hash	malicious	MassLogger RAT	Browse	194.15.112.248
	Ref#103052.exe	Get hash	malicious	XWorm	Browse	194.15.112.248
	9876567899.bat.exe	Get hash	malicious	Lokibot	Browse	194.15.112.248
	Ref_31020563.exe	Get hash	malicious	Unknown	Browse	194.15.112.248
	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse	194.15.112.248
	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse	194.15.112.248
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	194.15.112.248
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse	194.15.112.248
	KyrazonSetup.exe	Get hash	malicious	Unknown	Browse	194.15.112.248

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	AHSlIDftf1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	194.15.112.248
	eLo1khn7DQ.exe	Get hash	malicious	MassLogger RAT	Browse	194.15.112.248
	grW5hyK960.exe	Get hash	malicious	Unknown	Browse	194.15.112.248
	MzqLQjCwrw.exe	Get hash	malicious	MassLogger RAT	Browse	194.15.112.248
	grW5hyK960.exe	Get hash	malicious	Unknown	Browse	194.15.112.248
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	194.15.112.248
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	194.15.112.248
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse	194.15.112.248
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	194.15.112.248

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.036908290750075
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MWP0FO5rAF.exe
File size:	1'072'096 bytes
MD5:	79e059e518b08adbf428180b3e05495e
SHA1:	53dec3a16758aeb96a1afce4245b26c56d53d40a
SHA256:	f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce
SHA512:	ea2cf8b54c29f83cd49d997a849bc4c1ad264738a7e353450f361cbb086febb317065607d0ef97d921d701632f4c8f88247e7b27681bd5ee73c58d6735a2133e
SSDEEP:	12288:q5WKZq9ivLuQrN7QYzm7GfnKt8AmKCwTNeCSlyF1TdQL0q82gev0oOKHGTLu3p/s:xWKMKNRGQPhnklmiA
TLSH:	9C350E67798EA7B0E2007B33D9975C988391FE47371BC21B398B375E28167BE8941607
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.bg.....................J......N.... ... ....@.. ....................................`................................

File Icon


Icon Hash:	27d8dcd6d4d85007

Static PE Info

General

Entrypoint:	0x50114e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67620C33 [Tue Dec 17 23:41:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	04/07/2024 05:35:32 15/05/2027 16:15:04
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=VN, OID.2.5.4.15=Private Organization, CN="DUC FABULOUS CO.,LTD", SERIALNUMBER=0105838409, O="DUC FABULOUS CO.,LTD", L=Hanoi, C=VN
Version:	3
Thumbprint MD5:	FF0E889D2A73C3A679605952D35452DC
Thumbprint SHA-1:	2C1D12F8BBE0827400A8440AF74FFFA8DCC8097C
Thumbprint SHA-256:	A73352D67693AA16BCE2F182B15891F0F23EA0485CC18938686AAFDEE7B743E3
Serial:	6DD2E3173995F51BFAC1D9FB4CB200C1

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x101100	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x102000	0x4660	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x103e00	0x1de0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x108000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xff154	0xff200	a1ed6360ea9b98d854b70ba5bd351cad	False	0.38527089202596765	data	5.009681012477672	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x102000	0x4660	0x4800	a705be67d99cc110d1062f2357d64091	False	0.06125217013888889	data	2.4638252727598347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x108000	0xc	0x200	72f19fce66f0fb7eca718f0a5e428c32	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x102130	0x4028	Device independent bitmap graphic, 64 x 128 x 32, image size 0	0.02368485143692158
RT_GROUP_ICON	0x106158	0x14	data	1.05
RT_VERSION	0x10616c	0x308	data	0.4497422680412371
RT_MANIFEST	0x106474	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:56:45.262942+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49756	194.15.112.248	443	TCP
2025-01-10T18:56:47.750226+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49768	194.15.112.248	443	TCP
2025-01-10T18:56:49.563677+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49782	194.15.112.248	443	TCP
2025-01-10T18:56:51.472596+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49793	194.15.112.248	443	TCP
2025-01-10T18:56:54.066444+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49804	194.15.112.248	443	TCP
2025-01-10T18:57:04.976537+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49818	194.15.112.248	443	TCP
2025-01-10T18:57:07.198274+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49870	194.15.112.248	443	TCP
2025-01-10T18:57:09.070685+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49882	194.15.112.248	443	TCP
2025-01-10T18:57:14.387559+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49890	194.15.112.248	443	TCP
2025-01-10T18:57:16.475156+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49918	194.15.112.248	443	TCP
2025-01-10T18:57:18.321316+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49929	194.15.112.248	443	TCP
2025-01-10T18:57:20.678591+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49940	194.15.112.248	443	TCP
2025-01-10T18:57:23.008507+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49956	194.15.112.248	443	TCP
2025-01-10T18:57:26.260261+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49969	194.15.112.248	443	TCP
2025-01-10T18:57:28.212441+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49987	194.15.112.248	443	TCP
2025-01-10T18:57:30.055033+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49994	194.15.112.248	443	TCP
2025-01-10T18:57:31.880936+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49995	194.15.112.248	443	TCP
2025-01-10T18:57:33.707657+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49996	194.15.112.248	443	TCP
2025-01-10T18:57:35.545267+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49998	194.15.112.248	443	TCP
2025-01-10T18:57:37.368038+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49999	194.15.112.248	443	TCP
2025-01-10T18:57:39.204465+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50000	194.15.112.248	443	TCP
2025-01-10T18:57:41.155816+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50001	194.15.112.248	443	TCP
2025-01-10T18:57:42.991357+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50002	194.15.112.248	443	TCP
2025-01-10T18:57:47.943872+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50003	194.15.112.248	443	TCP
2025-01-10T18:57:49.763923+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50004	194.15.112.248	443	TCP
2025-01-10T18:57:51.709021+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50005	194.15.112.248	443	TCP
2025-01-10T18:57:54.004270+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50006	194.15.112.248	443	TCP
2025-01-10T18:57:56.279079+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50007	194.15.112.248	443	TCP
2025-01-10T18:57:58.182221+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50008	194.15.112.248	443	TCP
2025-01-10T18:58:03.357723+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50009	194.15.112.248	443	TCP
2025-01-10T18:58:05.352484+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50010	194.15.112.248	443	TCP
2025-01-10T18:58:08.400228+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50011	194.15.112.248	443	TCP
2025-01-10T18:58:11.363145+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50012	194.15.112.248	443	TCP
2025-01-10T18:58:13.298190+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50013	194.15.112.248	443	TCP
2025-01-10T18:58:15.369583+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50014	194.15.112.248	443	TCP
2025-01-10T18:58:17.259067+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50015	194.15.112.248	443	TCP
2025-01-10T18:58:19.820500+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50016	194.15.112.248	443	TCP
2025-01-10T18:58:21.892570+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50017	194.15.112.248	443	TCP
2025-01-10T18:58:23.831966+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50018	194.15.112.248	443	TCP
2025-01-10T18:58:26.700254+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50019	194.15.112.248	443	TCP
2025-01-10T18:58:28.806028+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50020	194.15.112.248	443	TCP
2025-01-10T18:58:30.761381+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50021	194.15.112.248	443	TCP
2025-01-10T18:58:35.672634+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50022	194.15.112.248	443	TCP
2025-01-10T18:58:37.672175+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50023	194.15.112.248	443	TCP
2025-01-10T18:58:40.462595+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50024	194.15.112.248	443	TCP
2025-01-10T18:58:42.473049+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50025	194.15.112.248	443	TCP
2025-01-10T18:58:44.761698+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50026	194.15.112.248	443	TCP
2025-01-10T18:58:46.559473+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50027	194.15.112.248	443	TCP
2025-01-10T18:58:48.936705+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50028	194.15.112.248	443	TCP
2025-01-10T18:58:51.239069+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50029	194.15.112.248	443	TCP
2025-01-10T18:58:52.997735+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50030	194.15.112.248	443	TCP
2025-01-10T18:58:54.802096+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50031	194.15.112.248	443	TCP
2025-01-10T18:58:56.547736+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50032	194.15.112.248	443	TCP
2025-01-10T18:58:59.233948+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50033	194.15.112.248	443	TCP
2025-01-10T18:59:01.075346+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50034	194.15.112.248	443	TCP
2025-01-10T18:59:04.968882+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50035	194.15.112.248	443	TCP
2025-01-10T18:59:06.742406+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50036	194.15.112.248	443	TCP
2025-01-10T18:59:08.519975+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50037	194.15.112.248	443	TCP
2025-01-10T18:59:10.285871+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50038	194.15.112.248	443	TCP
2025-01-10T18:59:15.112614+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50039	194.15.112.248	443	TCP
2025-01-10T18:59:16.869776+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50040	194.15.112.248	443	TCP
2025-01-10T18:59:18.744880+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50041	194.15.112.248	443	TCP
2025-01-10T18:59:20.555289+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50042	194.15.112.248	443	TCP
2025-01-10T18:59:22.282448+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50043	194.15.112.248	443	TCP
2025-01-10T18:59:24.055772+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50044	194.15.112.248	443	TCP
2025-01-10T18:59:26.034374+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50045	194.15.112.248	443	TCP
2025-01-10T18:59:28.936967+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50046	194.15.112.248	443	TCP
2025-01-10T18:59:30.692547+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50047	194.15.112.248	443	TCP
2025-01-10T18:59:32.461967+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50048	194.15.112.248	443	TCP
2025-01-10T18:59:34.373241+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50049	194.15.112.248	443	TCP
2025-01-10T18:59:36.192047+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50050	194.15.112.248	443	TCP
2025-01-10T18:59:38.207078+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50051	194.15.112.248	443	TCP
2025-01-10T18:59:40.094785+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50052	194.15.112.248	443	TCP
2025-01-10T18:59:42.129700+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50053	194.15.112.248	443	TCP
2025-01-10T18:59:43.967484+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50054	194.15.112.248	443	TCP
2025-01-10T18:59:45.905840+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50055	194.15.112.248	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:56:40.376784086 CET	49743	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:40.376805067 CET	443	49743	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:40.376898050 CET	49743	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:40.394967079 CET	49743	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:40.394977093 CET	443	49743	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:41.762125015 CET	443	49743	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:41.762227058 CET	49743	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:41.771735907 CET	49743	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:41.771744967 CET	443	49743	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:41.771987915 CET	443	49743	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:41.821357012 CET	49743	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:42.327380896 CET	49743	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:42.371320963 CET	443	49743	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:42.888323069 CET	443	49743	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:42.888349056 CET	443	49743	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:42.888396025 CET	49743	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:42.888411999 CET	443	49743	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:42.888448000 CET	49743	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:42.900851965 CET	49743	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:42.905908108 CET	49756	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:42.905937910 CET	443	49756	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:42.905997038 CET	49756	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:42.906248093 CET	49756	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:42.906255960 CET	443	49756	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:44.583870888 CET	443	49756	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:44.613621950 CET	49756	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:44.613660097 CET	443	49756	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:45.263052940 CET	443	49756	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:45.263108969 CET	443	49756	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:45.263168097 CET	49756	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:45.263220072 CET	443	49756	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:45.263253927 CET	443	49756	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:45.263303995 CET	49756	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:45.263642073 CET	49756	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:45.264204025 CET	49768	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:45.264236927 CET	443	49768	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:45.264426947 CET	49768	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:45.264564037 CET	49768	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:45.264580011 CET	443	49768	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:46.544620037 CET	443	49768	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:46.546231031 CET	49768	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:46.546264887 CET	443	49768	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:47.750341892 CET	443	49768	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:47.750399113 CET	443	49768	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:47.750531912 CET	443	49768	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:47.750643015 CET	49768	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:47.750643015 CET	49768	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:47.757595062 CET	49768	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:47.765103102 CET	49782	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:47.765130043 CET	443	49782	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:47.765297890 CET	49782	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:47.769205093 CET	49782	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:47.769220114 CET	443	49782	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:48.971225977 CET	443	49782	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:48.972897053 CET	49782	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:48.972910881 CET	443	49782	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:49.563688040 CET	443	49782	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:49.563713074 CET	443	49782	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:49.563770056 CET	443	49782	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:49.563805103 CET	49782	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:49.563805103 CET	49782	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:49.564435005 CET	49782	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:49.564692020 CET	49793	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:49.564722061 CET	443	49793	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:49.564779043 CET	49793	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:49.565051079 CET	49793	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:49.565064907 CET	443	49793	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:50.862461090 CET	443	49793	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:50.864171982 CET	49793	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:50.864238977 CET	443	49793	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:51.472596884 CET	443	49793	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:51.472625017 CET	443	49793	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:51.472687960 CET	443	49793	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:51.472740889 CET	49793	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:51.472888947 CET	49793	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:51.473331928 CET	49793	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:51.473813057 CET	49804	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:51.473858118 CET	443	49804	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:51.473927021 CET	49804	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:51.474128008 CET	49804	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:51.474148989 CET	443	49804	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:53.487616062 CET	443	49804	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:53.488992929 CET	49804	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:53.489001989 CET	443	49804	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:54.066581964 CET	443	49804	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:54.066637993 CET	443	49804	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:54.066699028 CET	49804	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:54.066711903 CET	443	49804	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:54.066804886 CET	443	49804	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:54.066926956 CET	49804	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:54.067423105 CET	49804	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:54.067976952 CET	49818	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:54.068069935 CET	443	49818	194.15.112.248	192.168.2.9
Jan 10, 2025 18:56:54.068468094 CET	49818	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:54.068692923 CET	49818	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:56:54.068730116 CET	443	49818	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:04.388576984 CET	443	49818	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:04.394078016 CET	49818	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:04.394105911 CET	443	49818	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:04.976622105 CET	443	49818	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:04.976686001 CET	443	49818	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:04.976757050 CET	49818	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:04.976829052 CET	443	49818	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:04.976883888 CET	443	49818	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:04.976948023 CET	49818	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:04.977334023 CET	49818	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:04.978095055 CET	49870	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:04.978152990 CET	443	49870	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:04.978235006 CET	49870	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:04.978527069 CET	49870	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:04.978560925 CET	443	49870	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:06.629453897 CET	443	49870	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:06.631351948 CET	49870	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:06.631396055 CET	443	49870	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:07.198285103 CET	443	49870	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:07.198307037 CET	443	49870	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:07.198379993 CET	443	49870	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:07.198420048 CET	49870	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:07.198476076 CET	49870	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:07.199060917 CET	49870	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:07.199691057 CET	49882	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:07.199727058 CET	443	49882	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:07.199806929 CET	49882	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:07.200067043 CET	49882	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:07.200083971 CET	443	49882	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:08.453099012 CET	443	49882	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:08.455102921 CET	49882	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:08.455116034 CET	443	49882	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:09.070705891 CET	443	49882	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:09.070732117 CET	443	49882	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:09.070796013 CET	443	49882	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:09.070832968 CET	49882	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:09.070873976 CET	49882	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:09.071548939 CET	49882	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:09.072232962 CET	49890	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:09.072263956 CET	443	49890	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:09.072374105 CET	49890	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:09.072664976 CET	49890	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:09.072681904 CET	443	49890	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:13.780531883 CET	443	49890	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:13.782040119 CET	49890	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:13.782078981 CET	443	49890	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:14.387569904 CET	443	49890	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:14.387595892 CET	443	49890	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:14.387658119 CET	443	49890	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:14.387690067 CET	49890	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:14.387717962 CET	49890	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:14.388428926 CET	49890	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:14.389298916 CET	49918	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:14.389322996 CET	443	49918	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:14.389381886 CET	49918	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:14.389625072 CET	49918	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:14.389637947 CET	443	49918	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:15.600922108 CET	443	49918	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:15.602607012 CET	49918	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:15.602629900 CET	443	49918	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:16.475147009 CET	443	49918	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:16.475178957 CET	443	49918	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:16.475246906 CET	443	49918	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:16.475272894 CET	49918	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:16.475336075 CET	49918	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:16.477334023 CET	49918	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:16.478198051 CET	49929	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:16.478245020 CET	443	49929	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:16.478313923 CET	49929	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:16.478545904 CET	49929	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:16.478563070 CET	443	49929	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:17.697530031 CET	443	49929	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:17.699245930 CET	49929	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:17.699263096 CET	443	49929	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:18.321335077 CET	443	49929	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:18.321362019 CET	443	49929	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:18.321425915 CET	443	49929	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:18.321590900 CET	49929	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:18.322163105 CET	49929	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:18.322683096 CET	49940	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:18.322732925 CET	443	49940	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:18.322818995 CET	49940	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:18.323023081 CET	49940	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:18.323035002 CET	443	49940	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:20.045519114 CET	443	49940	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:20.047341108 CET	49940	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:20.047383070 CET	443	49940	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:20.678653955 CET	443	49940	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:20.678718090 CET	443	49940	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:20.678792953 CET	49940	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:20.678817034 CET	443	49940	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:20.679003954 CET	443	49940	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:20.679060936 CET	49940	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:20.679409981 CET	49940	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:20.679924965 CET	49956	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:20.679949045 CET	443	49956	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:20.680018902 CET	49956	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:20.680258036 CET	49956	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:20.680268049 CET	443	49956	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:21.958250046 CET	443	49956	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:21.960055113 CET	49956	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:21.960095882 CET	443	49956	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:23.008537054 CET	443	49956	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:23.008562088 CET	443	49956	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:23.008632898 CET	443	49956	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:23.008750916 CET	49956	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:23.009390116 CET	49956	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:23.009881020 CET	49969	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:23.009927988 CET	443	49969	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:23.010019064 CET	49969	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:23.010206938 CET	49969	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:23.010227919 CET	443	49969	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:25.643986940 CET	443	49969	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:25.645649910 CET	49969	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:25.645673037 CET	443	49969	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:26.260358095 CET	443	49969	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:26.260417938 CET	443	49969	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:26.260535002 CET	49969	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:26.260550022 CET	443	49969	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:26.260579109 CET	443	49969	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:26.260937929 CET	49969	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:26.302423954 CET	49969	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:26.303457975 CET	49987	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:26.303503990 CET	443	49987	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:26.303580999 CET	49987	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:26.304141045 CET	49987	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:26.304160118 CET	443	49987	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:27.629753113 CET	443	49987	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:27.631437063 CET	49987	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:27.631464958 CET	443	49987	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:28.212449074 CET	443	49987	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:28.212479115 CET	443	49987	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:28.212558985 CET	443	49987	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:28.212600946 CET	49987	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:28.212675095 CET	49987	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:28.213099957 CET	49987	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:28.213681936 CET	49994	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:28.213733912 CET	443	49994	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:28.213809013 CET	49994	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:28.214049101 CET	49994	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:28.214062929 CET	443	49994	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:29.417953968 CET	443	49994	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:29.419754028 CET	49994	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:29.419787884 CET	443	49994	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:30.055052996 CET	443	49994	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:30.055078983 CET	443	49994	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:30.055151939 CET	443	49994	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:30.055181980 CET	49994	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:30.055218935 CET	49994	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:30.055752039 CET	49994	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:30.056489944 CET	49995	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:30.056525946 CET	443	49995	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:30.056622982 CET	49995	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:30.056843042 CET	49995	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:30.056859016 CET	443	49995	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:31.233366966 CET	443	49995	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:31.234980106 CET	49995	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:31.235007048 CET	443	49995	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:31.880951881 CET	443	49995	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:31.880975962 CET	443	49995	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:31.881042004 CET	443	49995	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:31.881151915 CET	49995	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:31.881151915 CET	49995	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:31.882245064 CET	49995	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:31.882311106 CET	49996	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:31.882344007 CET	443	49996	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:31.882424116 CET	49996	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:31.883296967 CET	49996	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:31.883312941 CET	443	49996	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:33.090307951 CET	443	49996	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:33.102442980 CET	49996	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:33.102463007 CET	443	49996	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:33.707674980 CET	443	49996	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:33.707700968 CET	443	49996	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:33.707766056 CET	49996	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:33.707779884 CET	443	49996	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:33.707793951 CET	443	49996	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:33.707839012 CET	49996	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:33.708220005 CET	49996	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:33.708729029 CET	49998	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:33.708750963 CET	443	49998	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:33.708826065 CET	49998	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:33.709019899 CET	49998	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:33.709033966 CET	443	49998	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:34.922853947 CET	443	49998	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:34.924637079 CET	49998	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:34.924650908 CET	443	49998	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:35.545243025 CET	443	49998	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:35.545260906 CET	443	49998	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:35.545347929 CET	49998	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:35.545351982 CET	443	49998	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:35.548543930 CET	49998	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:35.552397966 CET	49998	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:35.560302973 CET	49999	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:35.560355902 CET	443	49999	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:35.560434103 CET	49999	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:35.564126015 CET	49999	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:35.564163923 CET	443	49999	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:36.759484053 CET	443	49999	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:36.761069059 CET	49999	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:36.761113882 CET	443	49999	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:37.368065119 CET	443	49999	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:37.368086100 CET	443	49999	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:37.368175983 CET	443	49999	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:37.368199110 CET	49999	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:37.368228912 CET	49999	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:37.368697882 CET	49999	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:37.369183064 CET	50000	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:37.369220972 CET	443	50000	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:37.369518995 CET	50000	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:37.369777918 CET	50000	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:37.369796991 CET	443	50000	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:38.612900019 CET	443	50000	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:38.614720106 CET	50000	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:38.614742994 CET	443	50000	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:39.204497099 CET	443	50000	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:39.204525948 CET	443	50000	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:39.204612970 CET	443	50000	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:39.204648972 CET	50000	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:39.204682112 CET	50000	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:39.205166101 CET	50000	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:39.205817938 CET	50001	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:39.205869913 CET	443	50001	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:39.205957890 CET	50001	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:39.206163883 CET	50001	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:39.206176996 CET	443	50001	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:40.540468931 CET	443	50001	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:40.542081118 CET	50001	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:40.542110920 CET	443	50001	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:41.155832052 CET	443	50001	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:41.155848980 CET	443	50001	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:41.155915022 CET	443	50001	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:41.155921936 CET	50001	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:41.155970097 CET	50001	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:41.156537056 CET	50001	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:41.157073021 CET	50002	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:41.157126904 CET	443	50002	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:41.157201052 CET	50002	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:41.157408953 CET	50002	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:41.157427073 CET	443	50002	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:42.412441015 CET	443	50002	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:42.414359093 CET	50002	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:42.414376020 CET	443	50002	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:42.991352081 CET	443	50002	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:42.991398096 CET	443	50002	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:42.991489887 CET	443	50002	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:42.991530895 CET	50002	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:42.991559029 CET	50002	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:42.992156029 CET	50002	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:42.992856026 CET	50003	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:42.992904902 CET	443	50003	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:42.992978096 CET	50003	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:42.993277073 CET	50003	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:42.993293047 CET	443	50003	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:47.332374096 CET	443	50003	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:47.341331005 CET	50003	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:47.341356039 CET	443	50003	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:47.943869114 CET	443	50003	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:47.943897963 CET	443	50003	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:47.943975925 CET	443	50003	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:47.944052935 CET	50003	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:47.944516897 CET	50003	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:47.944658041 CET	50003	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:47.945507050 CET	50004	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:47.945554018 CET	443	50004	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:47.945641994 CET	50004	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:47.945935965 CET	50004	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:47.945947886 CET	443	50004	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:49.137306929 CET	443	50004	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:49.139209032 CET	50004	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:49.139242887 CET	443	50004	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:49.763864994 CET	443	50004	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:49.763911009 CET	443	50004	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:49.764003992 CET	443	50004	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:49.764055014 CET	50004	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:49.764127970 CET	50004	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:49.771773100 CET	50004	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:49.789098024 CET	50005	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:49.789151907 CET	443	50005	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:49.789271116 CET	50005	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:49.808769941 CET	50005	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:49.808796883 CET	443	50005	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:51.112518072 CET	443	50005	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:51.114439011 CET	50005	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:51.114449978 CET	443	50005	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:51.709036112 CET	443	50005	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:51.709062099 CET	443	50005	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:51.709129095 CET	443	50005	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:51.709296942 CET	50005	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:51.709296942 CET	50005	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:51.709861040 CET	50005	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:51.710309029 CET	50006	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:51.710357904 CET	443	50006	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:51.712599039 CET	50006	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:51.712841988 CET	50006	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:51.712877989 CET	443	50006	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:53.376353025 CET	443	50006	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:53.378144979 CET	50006	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:53.378182888 CET	443	50006	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:54.004292965 CET	443	50006	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:54.004318953 CET	443	50006	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:54.004393101 CET	443	50006	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:54.004412889 CET	50006	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:54.004460096 CET	50006	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:54.005080938 CET	50006	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:54.005695105 CET	50007	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:54.005740881 CET	443	50007	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:54.005822897 CET	50007	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:54.006156921 CET	50007	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:54.006171942 CET	443	50007	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:55.699769020 CET	443	50007	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:55.701680899 CET	50007	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:55.701697111 CET	443	50007	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:56.279086113 CET	443	50007	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:56.279114008 CET	443	50007	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:56.279187918 CET	443	50007	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:56.279282093 CET	50007	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:56.279762030 CET	50007	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:56.279762030 CET	50007	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:56.280267000 CET	50008	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:56.280365944 CET	443	50008	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:56.281239986 CET	50008	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:56.281444073 CET	50008	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:56.281519890 CET	443	50008	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:57.600277901 CET	443	50008	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:57.602125883 CET	50008	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:57.602142096 CET	443	50008	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:58.182241917 CET	443	50008	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:58.182270050 CET	443	50008	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:58.182343960 CET	443	50008	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:58.182492971 CET	50008	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:58.182492971 CET	50008	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:58.182980061 CET	50008	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:58.183509111 CET	50009	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:58.183542967 CET	443	50009	194.15.112.248	192.168.2.9
Jan 10, 2025 18:57:58.183615923 CET	50009	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:58.183829069 CET	50009	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:57:58.183837891 CET	443	50009	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:02.727951050 CET	443	50009	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:02.729799986 CET	50009	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:02.729816914 CET	443	50009	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:03.357726097 CET	443	50009	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:03.357750893 CET	443	50009	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:03.357801914 CET	50009	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:03.357815981 CET	443	50009	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:03.357842922 CET	443	50009	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:03.357881069 CET	50009	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:03.358472109 CET	50009	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:03.359276056 CET	50010	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:03.359347105 CET	443	50010	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:03.359432936 CET	50010	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:03.359775066 CET	50010	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:03.359802008 CET	443	50010	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:04.723247051 CET	443	50010	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:04.725097895 CET	50010	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:04.725135088 CET	443	50010	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:05.352499008 CET	443	50010	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:05.352523088 CET	443	50010	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:05.352612019 CET	50010	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:05.352617025 CET	443	50010	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:05.352665901 CET	50010	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:05.353221893 CET	50010	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:05.353858948 CET	50011	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:05.353894949 CET	443	50011	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:05.353965998 CET	50011	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:05.354206085 CET	50011	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:05.354222059 CET	443	50011	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:06.646699905 CET	443	50011	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:06.648441076 CET	50011	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:06.648461103 CET	443	50011	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:08.400285006 CET	443	50011	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:08.400368929 CET	443	50011	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:08.400458097 CET	50011	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:08.400494099 CET	443	50011	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:08.400635004 CET	443	50011	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:08.400697947 CET	50011	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:08.401022911 CET	50011	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:08.401570082 CET	50012	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:08.401607037 CET	443	50012	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:08.401678085 CET	50012	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:08.401885033 CET	50012	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:08.401896954 CET	443	50012	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:10.308731079 CET	443	50012	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:10.310523987 CET	50012	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:10.310549021 CET	443	50012	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:11.363161087 CET	443	50012	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:11.363182068 CET	443	50012	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:11.363255978 CET	443	50012	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:11.363270998 CET	50012	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:11.363307953 CET	50012	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:11.363806009 CET	50012	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:11.364341021 CET	50013	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:11.364397049 CET	443	50013	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:11.364464998 CET	50013	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:11.364687920 CET	50013	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:11.364702940 CET	443	50013	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:12.670574903 CET	443	50013	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:12.672324896 CET	50013	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:12.672363997 CET	443	50013	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:13.298151016 CET	443	50013	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:13.298166037 CET	443	50013	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:13.298232079 CET	443	50013	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:13.298302889 CET	50013	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:13.298680067 CET	50013	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:13.304066896 CET	50013	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:13.305381060 CET	50014	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:13.305425882 CET	443	50014	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:13.305505037 CET	50014	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:13.305845022 CET	50014	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:13.305859089 CET	443	50014	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:14.515490055 CET	443	50014	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:14.517669916 CET	50014	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:14.517703056 CET	443	50014	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:15.369581938 CET	443	50014	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:15.369606972 CET	443	50014	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:15.369676113 CET	443	50014	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:15.369678974 CET	50014	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:15.369719028 CET	50014	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:15.370676994 CET	50014	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:15.372047901 CET	50015	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:15.372097969 CET	443	50015	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:15.372164965 CET	50015	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:15.372858047 CET	50015	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:15.372873068 CET	443	50015	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:16.607271910 CET	443	50015	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:16.609286070 CET	50015	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:16.609318972 CET	443	50015	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:17.259171963 CET	443	50015	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:17.259232998 CET	443	50015	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:17.259408951 CET	443	50015	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:17.259480000 CET	50015	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:17.259480000 CET	50015	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:17.259943962 CET	50015	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:17.260864973 CET	50016	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:17.260931969 CET	443	50016	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:17.261110067 CET	50016	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:17.261759043 CET	50016	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:17.261776924 CET	443	50016	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:19.186706066 CET	443	50016	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:19.190602064 CET	50016	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:19.190623999 CET	443	50016	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:19.820365906 CET	443	50016	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:19.820456028 CET	443	50016	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:19.820559025 CET	50016	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:19.820583105 CET	443	50016	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:19.820619106 CET	443	50016	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:19.820753098 CET	50016	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:19.833755970 CET	50016	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:19.847333908 CET	50017	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:19.847382069 CET	443	50017	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:19.849107027 CET	50017	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:19.851336956 CET	50017	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:19.851353884 CET	443	50017	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:21.224385023 CET	443	50017	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:21.226932049 CET	50017	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:21.226949930 CET	443	50017	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:21.892579079 CET	443	50017	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:21.892649889 CET	443	50017	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:21.892712116 CET	50017	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:21.892738104 CET	443	50017	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:21.892800093 CET	443	50017	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:21.892899990 CET	50017	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:21.893420935 CET	50017	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:21.893896103 CET	50018	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:21.893942118 CET	443	50018	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:21.894011021 CET	50018	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:21.894229889 CET	50018	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:21.894243002 CET	443	50018	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:23.183800936 CET	443	50018	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:23.185992002 CET	50018	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:23.186005116 CET	443	50018	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:23.831974983 CET	443	50018	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:23.831999063 CET	443	50018	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:23.832068920 CET	443	50018	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:23.832086086 CET	50018	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:23.832150936 CET	50018	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:23.832679987 CET	50018	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:23.834429979 CET	50019	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:23.834475994 CET	443	50019	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:23.834779024 CET	50019	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:23.834779024 CET	50019	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:23.834824085 CET	443	50019	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:25.004220009 CET	443	50019	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:25.006169081 CET	50019	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:25.006185055 CET	443	50019	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:26.700280905 CET	443	50019	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:26.700309992 CET	443	50019	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:26.700392962 CET	443	50019	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:26.700460911 CET	50019	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:26.700654984 CET	50019	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:26.701036930 CET	50019	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:26.701644897 CET	50020	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:26.701689959 CET	443	50020	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:26.701773882 CET	50020	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:26.702064037 CET	50020	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:26.702074051 CET	443	50020	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:28.163573980 CET	443	50020	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:28.165466070 CET	50020	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:28.165508032 CET	443	50020	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:28.806042910 CET	443	50020	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:28.806060076 CET	443	50020	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:28.806126118 CET	443	50020	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:28.806152105 CET	50020	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:28.806227922 CET	50020	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:28.812786102 CET	50020	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:28.813328981 CET	50021	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:28.813394070 CET	443	50021	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:28.813468933 CET	50021	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:28.813692093 CET	50021	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:28.813707113 CET	443	50021	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:30.061431885 CET	443	50021	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:30.063143969 CET	50021	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:30.063158989 CET	443	50021	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:30.761398077 CET	443	50021	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:30.761425972 CET	443	50021	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:30.761499882 CET	443	50021	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:30.761540890 CET	50021	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:30.761569023 CET	50021	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:30.762084007 CET	50021	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:30.762625933 CET	50022	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:30.762669086 CET	443	50022	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:30.762763977 CET	50022	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:30.763006926 CET	50022	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:30.763020039 CET	443	50022	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:35.097839117 CET	443	50022	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:35.099513054 CET	50022	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:35.099554062 CET	443	50022	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:35.672617912 CET	443	50022	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:35.672645092 CET	443	50022	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:35.672717094 CET	50022	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:35.672732115 CET	443	50022	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:35.672750950 CET	443	50022	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:35.672827959 CET	50022	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:35.673208952 CET	50022	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:35.673898935 CET	50023	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:35.673944950 CET	443	50023	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:35.674079895 CET	50023	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:35.674299955 CET	50023	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:35.674314022 CET	443	50023	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:37.063929081 CET	443	50023	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:37.065480947 CET	50023	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:37.065500021 CET	443	50023	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:37.672192097 CET	443	50023	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:37.672215939 CET	443	50023	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:37.672285080 CET	443	50023	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:37.672357082 CET	50023	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:37.672357082 CET	50023	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:37.672911882 CET	50023	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:37.673497915 CET	50024	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:37.673559904 CET	443	50024	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:37.673641920 CET	50024	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:37.673871040 CET	50024	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:37.673885107 CET	443	50024	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:38.851033926 CET	443	50024	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:38.853002071 CET	50024	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:38.853030920 CET	443	50024	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:40.462492943 CET	443	50024	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:40.462553978 CET	443	50024	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:40.462697983 CET	50024	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:40.462712049 CET	443	50024	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:40.462785959 CET	50024	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:40.463779926 CET	50024	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:40.466344118 CET	50025	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:40.466387033 CET	443	50025	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:40.466454029 CET	50025	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:40.466856956 CET	50025	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:40.466875076 CET	443	50025	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:41.696006060 CET	443	50025	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:41.697968006 CET	50025	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:41.698000908 CET	443	50025	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:42.473056078 CET	443	50025	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:42.524801970 CET	50025	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:42.524831057 CET	443	50025	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:42.571746111 CET	50025	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:42.728346109 CET	443	50025	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:42.728414059 CET	443	50025	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:42.728483915 CET	50025	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:42.728866100 CET	50025	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:42.729438066 CET	50026	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:42.729476929 CET	443	50026	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:42.729557991 CET	50026	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:42.729789019 CET	50026	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:42.729796886 CET	443	50026	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:43.987462997 CET	443	50026	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:43.989093065 CET	50026	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:43.989121914 CET	443	50026	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:44.761753082 CET	443	50026	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:44.761811972 CET	443	50026	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:44.761878014 CET	50026	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:44.761908054 CET	443	50026	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:44.761962891 CET	443	50026	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:44.762017965 CET	50026	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:44.762307882 CET	50026	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:44.762867928 CET	50027	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:44.762913942 CET	443	50027	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:44.762996912 CET	50027	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:44.763197899 CET	50027	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:44.763214111 CET	443	50027	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:45.978424072 CET	443	50027	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:45.980092049 CET	50027	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:45.980125904 CET	443	50027	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:46.559535027 CET	443	50027	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:46.559585094 CET	443	50027	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:46.559746027 CET	443	50027	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:46.559801102 CET	50027	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:46.559801102 CET	50027	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:46.560277939 CET	50027	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:46.560980082 CET	50028	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:46.561032057 CET	443	50028	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:46.561127901 CET	50028	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:46.561707020 CET	50028	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:46.561723948 CET	443	50028	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:47.851635933 CET	443	50028	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:47.853468895 CET	50028	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:47.853492022 CET	443	50028	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:48.936765909 CET	443	50028	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:48.936832905 CET	443	50028	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:48.936975002 CET	50028	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:48.936995983 CET	443	50028	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:48.937118053 CET	50028	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:48.937463045 CET	50028	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:48.938024044 CET	50029	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:48.938082933 CET	443	50029	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:48.938158989 CET	50029	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:48.938452959 CET	50029	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:48.938465118 CET	443	50029	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:50.630037069 CET	443	50029	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:50.631762981 CET	50029	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:50.631797075 CET	443	50029	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:51.239154100 CET	443	50029	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:51.239191055 CET	443	50029	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:51.239305973 CET	50029	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:51.239341021 CET	443	50029	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:51.239356041 CET	443	50029	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:51.239484072 CET	50029	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:51.239892006 CET	50029	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:51.240436077 CET	50030	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:51.240482092 CET	443	50030	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:51.240562916 CET	50030	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:51.240773916 CET	50030	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:51.240792036 CET	443	50030	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:52.403093100 CET	443	50030	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:52.407020092 CET	50030	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:52.407056093 CET	443	50030	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:52.997813940 CET	443	50030	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:52.997864962 CET	443	50030	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:52.998016119 CET	443	50030	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:52.998056889 CET	50030	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:52.998076916 CET	50030	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:52.998507977 CET	50030	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:52.999057055 CET	50031	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:52.999100924 CET	443	50031	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:52.999175072 CET	50031	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:52.999398947 CET	50031	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:52.999414921 CET	443	50031	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:54.209204912 CET	443	50031	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:54.211404085 CET	50031	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:54.211440086 CET	443	50031	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:54.802268982 CET	443	50031	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:54.802298069 CET	443	50031	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:54.802381039 CET	443	50031	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:54.802544117 CET	50031	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:54.802545071 CET	50031	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:54.803222895 CET	50031	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:54.803926945 CET	50032	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:54.803977013 CET	443	50032	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:54.804058075 CET	50032	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:54.804308891 CET	50032	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:54.804326057 CET	443	50032	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:55.959177971 CET	443	50032	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:55.968898058 CET	50032	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:55.968924999 CET	443	50032	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:56.547764063 CET	443	50032	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:56.547799110 CET	443	50032	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:56.547882080 CET	443	50032	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:56.547935009 CET	50032	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:56.547995090 CET	50032	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:56.548708916 CET	50032	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:56.549443960 CET	50033	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:56.549561977 CET	443	50033	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:56.549666882 CET	50033	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:56.549942017 CET	50033	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:56.549973011 CET	443	50033	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:58.167787075 CET	443	50033	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:58.169481039 CET	50033	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:58.169506073 CET	443	50033	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:59.233930111 CET	443	50033	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:59.233948946 CET	443	50033	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:59.234018087 CET	443	50033	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:59.234101057 CET	50033	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:59.234203100 CET	50033	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:59.234735966 CET	50033	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:59.235455036 CET	50034	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:59.235490084 CET	443	50034	194.15.112.248	192.168.2.9
Jan 10, 2025 18:58:59.235611916 CET	50034	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:59.235939026 CET	50034	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:58:59.235945940 CET	443	50034	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:00.477885962 CET	443	50034	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:00.479769945 CET	50034	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:00.479784012 CET	443	50034	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:01.075345993 CET	443	50034	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:01.075371027 CET	443	50034	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:01.075429916 CET	50034	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:01.075443983 CET	443	50034	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:01.075469017 CET	443	50034	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:01.075509071 CET	50034	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:01.076112986 CET	50034	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:01.076750994 CET	50035	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:01.076797962 CET	443	50035	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:01.076869965 CET	50035	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:01.077184916 CET	50035	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:01.077200890 CET	443	50035	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:02.683208942 CET	443	50035	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:02.685136080 CET	50035	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:02.685157061 CET	443	50035	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:04.968877077 CET	443	50035	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:04.968894958 CET	443	50035	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:04.968961954 CET	443	50035	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:04.969022989 CET	50035	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:04.969063044 CET	50035	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:04.969679117 CET	50035	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:04.970355034 CET	50036	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:04.970398903 CET	443	50036	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:04.970488071 CET	50036	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:04.970716953 CET	50036	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:04.970729113 CET	443	50036	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:06.174092054 CET	443	50036	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:06.175817013 CET	50036	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:06.175848007 CET	443	50036	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:06.742433071 CET	443	50036	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:06.742465973 CET	443	50036	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:06.742542982 CET	443	50036	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:06.742592096 CET	50036	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:06.742592096 CET	50036	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:06.744621038 CET	50037	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:06.744623899 CET	50036	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:06.744656086 CET	443	50037	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:06.744719982 CET	50037	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:06.748619080 CET	50037	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:06.748630047 CET	443	50037	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:07.877866030 CET	443	50037	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:07.882404089 CET	50037	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:07.882424116 CET	443	50037	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:08.519937038 CET	443	50037	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:08.519953012 CET	443	50037	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:08.520030975 CET	443	50037	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:08.520083904 CET	50037	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:08.520083904 CET	50037	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:08.520912886 CET	50037	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:08.521485090 CET	50038	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:08.521536112 CET	443	50038	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:08.521646976 CET	50038	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:08.521868944 CET	50038	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:08.521884918 CET	443	50038	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:09.698534012 CET	443	50038	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:09.700431108 CET	50038	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:09.700459003 CET	443	50038	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:10.285949945 CET	443	50038	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:10.286015034 CET	443	50038	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:10.286171913 CET	443	50038	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:10.286170006 CET	50038	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:10.286833048 CET	50038	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:10.286833048 CET	50038	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:10.288625002 CET	50039	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:10.288690090 CET	443	50039	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:10.288764000 CET	50039	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:10.289833069 CET	50039	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:10.289856911 CET	443	50039	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:14.498099089 CET	443	50039	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:14.500185966 CET	50039	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:14.500197887 CET	443	50039	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:15.112696886 CET	443	50039	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:15.112756014 CET	443	50039	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:15.112884045 CET	50039	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:15.112901926 CET	443	50039	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:15.112920046 CET	443	50039	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:15.112971067 CET	50039	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:15.113656998 CET	50039	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:15.114443064 CET	50040	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:15.114506006 CET	443	50040	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:15.114605904 CET	50040	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:15.114856005 CET	50040	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:15.114871979 CET	443	50040	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:16.284045935 CET	443	50040	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:16.285955906 CET	50040	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:16.285975933 CET	443	50040	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:16.869690895 CET	443	50040	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:16.869714022 CET	443	50040	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:16.869791031 CET	443	50040	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:16.869820118 CET	50040	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:16.869851112 CET	50040	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:16.870466948 CET	50040	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:16.871089935 CET	50041	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:16.871129990 CET	443	50041	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:16.871211052 CET	50041	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:16.871444941 CET	50041	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:16.871457100 CET	443	50041	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:18.103924990 CET	443	50041	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:18.106059074 CET	50041	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:18.106096029 CET	443	50041	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:18.744899035 CET	443	50041	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:18.744925022 CET	443	50041	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:18.744986057 CET	443	50041	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:18.745124102 CET	50041	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:18.745124102 CET	50041	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:18.745651960 CET	50041	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:18.746304035 CET	50042	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:18.746346951 CET	443	50042	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:18.746701002 CET	50042	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:18.746942043 CET	50042	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:18.746954918 CET	443	50042	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:19.964701891 CET	443	50042	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:19.966620922 CET	50042	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:19.966644049 CET	443	50042	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:20.555310011 CET	443	50042	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:20.555346012 CET	443	50042	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:20.555413008 CET	443	50042	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:20.555461884 CET	50042	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:20.555486917 CET	50042	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:20.556142092 CET	50042	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:20.556794882 CET	50043	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:20.556829929 CET	443	50043	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:20.556915998 CET	50043	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:20.557148933 CET	50043	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:20.557158947 CET	443	50043	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:21.692770004 CET	443	50043	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:21.694832087 CET	50043	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:21.694863081 CET	443	50043	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:22.282457113 CET	443	50043	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:22.282479048 CET	443	50043	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:22.282542944 CET	443	50043	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:22.282639027 CET	50043	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:22.282665968 CET	50043	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:22.283322096 CET	50043	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:22.283940077 CET	50044	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:22.283976078 CET	443	50044	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:22.284064054 CET	50044	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:22.284280062 CET	50044	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:22.284288883 CET	443	50044	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:23.484088898 CET	443	50044	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:23.486033916 CET	50044	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:23.486068010 CET	443	50044	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:24.055785894 CET	443	50044	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:24.055816889 CET	443	50044	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:24.055890083 CET	443	50044	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:24.056004047 CET	50044	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:24.056004047 CET	50044	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:24.056596041 CET	50044	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:24.057198048 CET	50045	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:24.057246923 CET	443	50045	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:24.057332993 CET	50045	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:24.057560921 CET	50045	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:24.057580948 CET	443	50045	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:25.406584978 CET	443	50045	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:25.409492016 CET	50045	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:25.409528017 CET	443	50045	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:26.034396887 CET	443	50045	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:26.034432888 CET	443	50045	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:26.034513950 CET	443	50045	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:26.034809113 CET	50045	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:26.035377026 CET	50045	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:26.036045074 CET	50046	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:26.036108971 CET	443	50046	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:26.036202908 CET	50046	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:26.036456108 CET	50046	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:26.036474943 CET	443	50046	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:27.278666973 CET	443	50046	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:27.280591965 CET	50046	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:27.280617952 CET	443	50046	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:28.937012911 CET	443	50046	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:28.937052965 CET	443	50046	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:28.937206030 CET	50046	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:28.937216043 CET	443	50046	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:28.937311888 CET	50046	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:28.945405006 CET	50046	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:28.958245039 CET	50047	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:28.958297014 CET	443	50047	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:28.958375931 CET	50047	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:28.965199947 CET	50047	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:28.965229034 CET	443	50047	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:30.108702898 CET	443	50047	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:30.110676050 CET	50047	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:30.110702991 CET	443	50047	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:30.692600965 CET	443	50047	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:30.692660093 CET	443	50047	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:30.692740917 CET	50047	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:30.692771912 CET	443	50047	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:30.692832947 CET	443	50047	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:30.692972898 CET	50047	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:30.693353891 CET	50047	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:30.693945885 CET	50048	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:30.693979979 CET	443	50048	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:30.694056988 CET	50048	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:30.694353104 CET	50048	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:30.694369078 CET	443	50048	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:31.869589090 CET	443	50048	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:31.871400118 CET	50048	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:31.871417999 CET	443	50048	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:32.461997986 CET	443	50048	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:32.462028027 CET	443	50048	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:32.462110043 CET	443	50048	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:32.462230921 CET	50048	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:32.462230921 CET	50048	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:32.462912083 CET	50048	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:32.463532925 CET	50049	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:32.463574886 CET	443	50049	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:32.463692904 CET	50049	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:32.464096069 CET	50049	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:32.464106083 CET	443	50049	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:33.762417078 CET	443	50049	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:33.764264107 CET	50049	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:33.764276981 CET	443	50049	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:34.373256922 CET	443	50049	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:34.373281002 CET	443	50049	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:34.373347044 CET	443	50049	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:34.373373032 CET	50049	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:34.373421907 CET	50049	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:34.374061108 CET	50049	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:34.374646902 CET	50050	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:34.374689102 CET	443	50050	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:34.374932051 CET	50050	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:34.374999046 CET	50050	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:34.375013113 CET	443	50050	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:35.574971914 CET	443	50050	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:35.582425117 CET	50050	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:35.582453966 CET	443	50050	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:36.192065001 CET	443	50050	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:36.192102909 CET	443	50050	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:36.192171097 CET	443	50050	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:36.192210913 CET	50050	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:36.192368031 CET	50050	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:36.193161964 CET	50050	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:36.193810940 CET	50051	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:36.193850040 CET	443	50051	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:36.193936110 CET	50051	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:36.194173098 CET	50051	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:36.194184065 CET	443	50051	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:37.433089018 CET	443	50051	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:37.434791088 CET	50051	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:37.434808016 CET	443	50051	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:38.207077026 CET	443	50051	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:38.207102060 CET	443	50051	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:38.207165003 CET	443	50051	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:38.207205057 CET	50051	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:38.207248926 CET	50051	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:38.207700968 CET	50051	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:38.208276987 CET	50052	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:38.208311081 CET	443	50052	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:38.208395958 CET	50052	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:38.208623886 CET	50052	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:38.208631039 CET	443	50052	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:39.515595913 CET	443	50052	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:39.517544985 CET	50052	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:39.517566919 CET	443	50052	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:40.094748020 CET	443	50052	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:40.094773054 CET	443	50052	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:40.094832897 CET	443	50052	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:40.094919920 CET	50052	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:40.095114946 CET	50052	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:40.095520973 CET	50052	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:40.096107960 CET	50053	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:40.096162081 CET	443	50053	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:40.096266031 CET	50053	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:40.096482992 CET	50053	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:40.096503973 CET	443	50053	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:41.453495026 CET	443	50053	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:41.455141068 CET	50053	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:41.455176115 CET	443	50053	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:42.129694939 CET	443	50053	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:42.129728079 CET	443	50053	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:42.129795074 CET	443	50053	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:42.129818916 CET	50053	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:42.129858971 CET	50053	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:42.130415916 CET	50053	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:42.131062984 CET	50054	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:42.131098986 CET	443	50054	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:42.131181955 CET	50054	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:42.131401062 CET	50054	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:42.131407976 CET	443	50054	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:43.344877005 CET	443	50054	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:43.346719980 CET	50054	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:43.346738100 CET	443	50054	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:43.967490911 CET	443	50054	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:43.967513084 CET	443	50054	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:43.967578888 CET	443	50054	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:43.967597008 CET	50054	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:43.967631102 CET	50054	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:43.968225956 CET	50054	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:43.968839884 CET	50055	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:43.968902111 CET	443	50055	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:43.968987942 CET	50055	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:43.969216108 CET	50055	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:43.969224930 CET	443	50055	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:45.200392008 CET	443	50055	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:45.243664026 CET	50055	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:45.318805933 CET	50055	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:45.318834066 CET	443	50055	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:45.905831099 CET	443	50055	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:45.905858994 CET	443	50055	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:45.905936003 CET	443	50055	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:45.905961990 CET	50055	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:45.905992985 CET	50055	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:45.906537056 CET	50055	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:45.907095909 CET	50056	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:45.907182932 CET	443	50056	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:45.907275915 CET	50056	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:45.907470942 CET	50056	443	192.168.2.9	194.15.112.248
Jan 10, 2025 18:59:45.907502890 CET	443	50056	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:47.117379904 CET	443	50056	194.15.112.248	192.168.2.9
Jan 10, 2025 18:59:47.165673971 CET	50056	443	192.168.2.9	194.15.112.248

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:56:40.350308895 CET	56302	53	192.168.2.9	1.1.1.1
Jan 10, 2025 18:56:40.369090080 CET	53	56302	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:56:40.350308895 CET	192.168.2.9	1.1.1.1	0xe1e2	Standard query (0)	oshi.at	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:56:40.369090080 CET	1.1.1.1	192.168.2.9	0xe1e2	No error (0)	oshi.at		194.15.112.248	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:56:40.369090080 CET	1.1.1.1	192.168.2.9	0xe1e2	No error (0)	oshi.at		5.253.86.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

oshi.at

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49743	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:56:42 UTC	61	OUT	GET /gQkq HTTP/1.1 Host: oshi.at Connection: Keep-Alive
2025-01-10 17:56:42 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:56:42 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:56:42 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49756	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:56:44 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:56:45 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:56:45 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:56:45 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49768	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:56:46 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:56:47 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:56:47 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:56:47 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49782	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:56:48 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:56:49 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:56:49 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:56:49 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49793	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:56:50 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:56:51 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:56:51 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:56:51 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49804	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:56:53 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:56:54 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:56:53 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:56:54 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49818	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:04 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:04 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:04 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:04 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49870	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:06 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:07 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:07 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:07 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49882	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:08 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:09 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:08 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:09 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49890	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:13 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:14 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:14 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:14 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49918	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:15 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:16 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:16 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:16 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49929	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:17 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:18 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:18 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:18 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49940	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:20 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:20 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:20 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:20 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49956	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:21 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:23 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:22 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:23 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49969	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:25 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:26 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:26 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:26 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49987	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:27 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:28 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:28 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:28 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49994	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:29 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:30 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:29 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:30 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49995	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:31 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:31 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:31 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:31 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49996	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:33 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:33 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:33 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:33 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49998	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:34 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:35 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:35 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:35 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49999	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:36 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:37 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:37 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:37 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	50000	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:38 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:39 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:39 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:39 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	50001	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:40 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:41 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:40 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:41 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	50002	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:42 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:42 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:42 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:42 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	50003	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:47 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:47 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:47 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:47 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	50004	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:49 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:49 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:49 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:49 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	50005	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:51 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:51 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:51 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:51 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	50006	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:53 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:54 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:53 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:54 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	50007	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:55 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:56 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:56 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:56 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	50008	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:57:57 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:57:58 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:57:58 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:57:58 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	50009	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:02 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:03 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:03 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:03 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	50010	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:04 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:05 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:05 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:05 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	50011	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:06 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:08 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:08 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:08 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	50012	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:10 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:11 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:11 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:11 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	50013	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:12 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:13 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:13 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:13 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	50014	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:14 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:15 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:15 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:15 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	50015	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:16 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:17 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:17 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:17 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	50016	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:19 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:19 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:19 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:19 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	50017	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:21 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:21 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:21 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:21 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	50018	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:23 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:23 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:23 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:23 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	50019	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:25 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:26 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:26 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:26 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	50020	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:28 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:28 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:28 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:28 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	50021	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:30 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:30 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:30 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:30 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	50022	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:35 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:35 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:35 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:35 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	50023	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:37 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:37 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:37 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:37 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	50024	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:38 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:40 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:40 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:40 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	50025	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:41 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:42 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:42 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:42 UTC	1185	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up
2025-01-10 17:58:42 UTC	664	IN	Data Raw: 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 2f 63 6d 64 22 3e 43 6f 6d 6d 61 6e 64 2d 6c 69 6e 65 20 69 6e 74 65 72 66 61 63 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 63 6c 61 73 73 3d 22 6e 61 76 2d 6c 69 6e 6b 22 20 68 72 65 66 3d 22 2f 73 68 61 72 65 78 22 3e 53 68 61 72 65 58 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 6c 69 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 2d 69 74 65 6d 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 63 6c 61 73 Data Ascii: <a class="nav-link" href="/cmd">Command-line interface</a> </li> <li class="nav-item"> <a class="nav-link" href="/sharex">ShareX</a> </li> <li class="nav-item"> <a target="_blank" clas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	50026	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:43 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:44 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:44 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:44 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	50027	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:45 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:46 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:46 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:46 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.9	50028	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:47 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:48 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:48 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:48 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.9	50029	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:50 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:51 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:51 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:51 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	50030	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:52 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:52 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:52 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:52 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.9	50031	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:54 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:54 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:54 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:54 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.9	50032	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:55 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:56 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:56 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:56 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.9	50033	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:58:58 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:58:59 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:58:59 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:58:59 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.9	50034	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:00 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:01 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:00 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:01 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.9	50035	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:02 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:04 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:04 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:04 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.9	50036	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:06 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:06 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:06 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:06 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.9	50037	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:07 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:08 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:08 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:08 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.9	50038	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:09 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:10 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:10 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:10 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.9	50039	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:14 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:15 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:14 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:15 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.9	50040	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:16 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:16 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:16 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:16 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.9	50041	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:18 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:18 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:18 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:18 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.9	50042	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:19 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:20 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:20 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:20 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.9	50043	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:21 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:22 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:22 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:22 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.9	50044	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:23 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:24 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:23 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:24 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.9	50045	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:25 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:26 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:25 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:26 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.9	50046	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:27 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:28 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:28 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:28 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.9	50047	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:30 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:30 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:30 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:30 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.9	50048	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:31 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:32 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:32 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:32 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.9	50049	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:33 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:34 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:34 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:34 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.9	50050	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:35 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:36 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:36 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:36 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.9	50051	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:37 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:38 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:37 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:38 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.9	50052	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:39 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:40 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:39 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:40 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.9	50053	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:41 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:42 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:41 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:42 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.9	50054	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:43 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:43 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:43 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:43 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.9	50055	194.15.112.248	443	7596	C:\Users\user\Desktop\MWP0FO5rAF.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:59:45 UTC	37	OUT	GET /gQkq HTTP/1.1 Host: oshi.at
2025-01-10 17:59:45 UTC	158	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 17:59:45 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1849 Connection: close
2025-01-10 17:59:45 UTC	1849	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 65 63 75 72 65 20 66 69 6c 65 20 73 68 61 72 69 6e 67 2e 20 45 6e 63 72 79 70 74 65 64 20 73 65 72 76 65 72 2e 20 4e 6f 20 6c 6f 67 73 2e 20 54 43 50 20 61 6e 64 20 43 75 72 6c 20 75 70 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="description" content="Secure file sharing. Encrypted server. No logs. TCP and Curl up

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: MWP0FO5rAF.exePID: 7596, Parent PID: 3504

General

Target ID:	0
Start time:	12:56:38
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\MWP0FO5rAF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MWP0FO5rAF.exe"
Imagebase:	0x370000
File size:	1'072'096 bytes
MD5 hash:	79E059E518B08ADBF428180B3E05495E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: MWP0FO5rAF.exePID: 7596, Parent PID: 3504COMMON

Executed Functions

Function 00BD1658 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3222076354.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_MWP0FO5rAF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1497fce344ff9e4ec0224f2e3b9b9647bf4a6cc3cedca7dcc93d86981bd1c107
Instruction ID: dce573427506fe9bda9623e56f703dc4d141c4180f4c3739d994ccb4363b65fa
Opcode Fuzzy Hash: 1497fce344ff9e4ec0224f2e3b9b9647bf4a6cc3cedca7dcc93d86981bd1c107
Instruction Fuzzy Hash: 36C15E38A042089FDB00DB58D494BA9F7F2FF88304F2885A6D405AB769E7759C42CBA1

Function 00BD1648 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3222076354.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_MWP0FO5rAF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07257dc455e921d58620c02f500cc60fed8ed3a398c1f207fc483ebc81558918
Instruction ID: ebf41884fd508e37b80181703a44555cc339c5e87f56b2771b83990dee4387cd
Opcode Fuzzy Hash: 07257dc455e921d58620c02f500cc60fed8ed3a398c1f207fc483ebc81558918
Instruction Fuzzy Hash: D8A15B34A04104DFDB04DB68D494BA9F7F2FB88300F2899E6D405AB769E775EC81DBA4

Function 00BD1924 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3222076354.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_MWP0FO5rAF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0943dd601479f36bfa474053a94a466ef829c5a2162bcf193436f6830edc646
Instruction ID: aeb77e33cc632d563b486730a716b1f472e1c712d1482b7b1012605a50383a0e
Opcode Fuzzy Hash: a0943dd601479f36bfa474053a94a466ef829c5a2162bcf193436f6830edc646
Instruction Fuzzy Hash: C3A13A34A00108DFDB04DB58D594BA9F7F2FB88300F2899E6D405AB769E775EC81DBA4

Function 00BD0860 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3222076354.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_MWP0FO5rAF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa9dbc6a870b1aaaa4d65e20389983e72b018370c1262e20268dfeb8141d496
Instruction ID: f5b77fe86676c6398864bb043e94e2a34ee6a8b05498e97c6d0fb925244b29fd
Opcode Fuzzy Hash: faa9dbc6a870b1aaaa4d65e20389983e72b018370c1262e20268dfeb8141d496
Instruction Fuzzy Hash: 65E0124464F3C16FC7134370AC66109BF304A8320570946DFD4C9CB4E3C848452AC7A3

Function 00BD1365 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3222076354.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_MWP0FO5rAF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3efff5cc4397061799fcfb4ab43389a58469c16bda181bfd28b295da678c2b
Instruction ID: dfbe6fc269cb70a4e5e62603b70f13dd650b0135632221f81da69f59c9525d45
Opcode Fuzzy Hash: 1a3efff5cc4397061799fcfb4ab43389a58469c16bda181bfd28b295da678c2b
Instruction Fuzzy Hash: 1ED0A739921511CFE704DF158804298F3F0FB45300F4584F6C54563110F7315C458A90

Function 00BD0890 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3222076354.0000000000BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_MWP0FO5rAF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a564ac5ab460b8b7d02c0612105554e89e20ce25fccf6473032aad5ff29fb4b
Instruction ID: 493e29df999749d533c63ce6d74c065d1f0a393da8579e79ce318632740ba957
Opcode Fuzzy Hash: 5a564ac5ab460b8b7d02c0612105554e89e20ce25fccf6473032aad5ff29fb4b
Instruction Fuzzy Hash: 78902238080A0CCF080023E03808000330CC0800083800020B00C000030A8220000080

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MWP0FO5rAF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
MWP0FO5rAF.exe