Edit tour

Windows Analysis Report
https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php

Overview

General Information

Sample URL:	https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php
Analysis ID:	1648130
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Classification

Process Tree

System is w7x64

chrome.exe (PID: 3056 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 936 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1236,i,15996112504366120973,10164845657667848202,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

chrome.exe (PID: 1628 cmdline: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php" MD5: FFA2B8E17F645BCC20F0E0201FEF83ED)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php

Avira URL Cloud: detection malicious, Label: malware

Antivirus detection for URL or domain

Source: https://lawful-lamontagne-7e83y.zipwp.top/favicon.ico

Avira URL Cloud: Label: malware

Source: https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php

HTTP Parser: No favicon

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_3056_1196616230	Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.176.196:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.180:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.180:443 -> 192.168.2.22:49176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.180:443 -> 192.168.2.22:49178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.22:49180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.22:49181 version: TLS 1.2

Source: global traffic	HTTP traffic detected: GET /zipwp-login-67e2afa011731.php HTTP/1.1Host: lawful-lamontagne-7e83y.zipwp.topConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/lock-icon.svg HTTP/1.1Host: zipwp.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lawful-lamontagne-7e83y.zipwp.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/site-image.png HTTP/1.1Host: zipwp.comConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lawful-lamontagne-7e83y.zipwp.top/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/lock-icon.svg HTTP/1.1Host: zipwp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: lawful-lamontagne-7e83y.zipwp.topConnection: keep-alivesec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.phpAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/site-image.png HTTP/1.1Host: zipwp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: lawful-lamontagne-7e83y.zipwp.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lawful-lamontagne-7e83y.zipwp.top
Source: global traffic	DNS traffic detected: DNS query: zipwp.com

Source: chromecache_75.1.dr, chromecache_78.1.dr, chromecache_80.1.dr	String found in binary or memory: https://zipwp.com/
Source: chromecache_75.1.dr, chromecache_78.1.dr, chromecache_80.1.dr	String found in binary or memory: https://zipwp.com/images/lock-icon.svg
Source: chromecache_75.1.dr, chromecache_78.1.dr, chromecache_80.1.dr	String found in binary or memory: https://zipwp.com/images/site-image.png

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443

Source: unknown	HTTPS traffic detected: 142.250.176.196:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.22:49174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.180:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.180:443 -> 192.168.2.22:49176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.0.180:443 -> 192.168.2.22:49178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.22:49180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.22:49181 version: TLS 1.2

Source: classification engine

Classification label: mal56.win@18/13@10/6

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1236,i,15996112504366120973,10164845657667848202,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php"
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1236,i,15996112504366120973,10164845657667848202,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\Google\GoogleUpdater	Jump to behavior
Source: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	Directory created: C:\Program Files\chrome_BITS_3056_1196616230	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php	100%	Avira URL Cloud	malware

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://zipwp.com/	0%	Avira URL Cloud	safe
https://lawful-lamontagne-7e83y.zipwp.top/favicon.ico	100%	Avira URL Cloud	malware
https://zipwp.com/images/lock-icon.svg	0%	Avira URL Cloud	safe
https://zipwp.com/images/site-image.png	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
lawful-lamontagne-7e83y.zipwp.top	148.135.1.141	true	false	unknown
www.google.com	142.250.176.196	true	false	high
zipwp.com	104.26.1.180	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://zipwp.com/images/lock-icon.svg	false	Avira URL Cloud: safe	unknown
https://zipwp.com/images/site-image.png	false	Avira URL Cloud: safe	unknown
https://lawful-lamontagne-7e83y.zipwp.top/favicon.ico	false	Avira URL Cloud: malware	unknown
https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://zipwp.com/	chromecache_75.1.dr, chromecache_78.1.dr, chromecache_80.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.1.180	zipwp.com	United States	13335	CLOUDFLARENETUS	false
142.250.176.196	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
148.135.1.141	lawful-lamontagne-7e83y.zipwp.top	Sweden	158	ERI-ASUS	false
104.26.0.180	unknown	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648130
Start date and time:	2025-03-25 15:13:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@18/13@10/6

Warnings

Exclude process from analysis (whitelisted): vga.dll, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 142.251.41.3, 142.250.80.110, 142.251.167.84, 142.251.40.174, 142.250.64.74, 142.250.65.170, 142.250.72.106, 142.251.40.170, 142.250.80.10, 142.250.80.106, 142.251.40.138, 142.251.35.170, 142.250.80.74, 142.251.40.106, 142.250.81.234, 142.250.64.106, 142.250.65.234, 142.251.32.106, 142.250.65.202, 142.250.80.42, 142.251.40.227, 34.104.35.123
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, content-autofill.googleapis.com, edgedl.me.gvt1.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1200 x 1080, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	938994
Entropy (8bit):	7.990755330865723
Encrypted:	true
SSDEEP:	24576:wbae0EpqD+27Feoj8RA3z3lfYh+1MeKlGw5m1:KaTf+2JcAjVfc+1MeKln5S
MD5:	364120324661D7263C4B6DEEA15F9ADE
SHA1:	2CDC7A50695B8738C62BBD560535885CF90334CB
SHA-256:	07E79354AD059F0727D39A389C6EA9E870681A3D915DC5DCFDE9B2406F218068
SHA-512:	F3A02377260FD06030BCA53D01918778A18B091124D5699AB67571851BE9E57DC7AC84B697882A9364D7CCE047981761305EC92FED9D880021B65BE8D54A8AF0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......8.......%z....pHYs.................sRGB.........gAMA......a...S.IDATx...k.#..-..&E.u.._=....{Ue..-.....&.8...L.If\|. ..IP.....k.N.3...x&K..o.].{.cK.xv....3..]......Y...+.c..%.R>\|G[....a..:?=.E9-.,y.....s........8.l.g...1...o..J..^.3............^0..ZcxM....x,c'..w..J...\|...8b........y.'.}...FF;oz.m......3..x.^.......8...0...M.G..}.:...?.~.....K....\|.i0.r.\|.............n.......8.0.l..<....q..Bsc::V....^./.^M...a....c,......z......<,..v..e..}.:o..Z...\..N.Q7jN.x...;:\a.4....\|.+.......{..\|?.?&^....4...5...u...1..~..1.0V....p.)..x.,u.\..m.O.n._T...<r......JMkC...............K.........C........:.....b..z..96c~KI...t.]..\|..M:Q....4....=iX.G.w..y/.r....}k.F...?....-...m.e.....0&....u...k....R^o.=........s..s...}.z.%...w.17.;......m.G{....z.cb......z.G.y.o.l.?..x\|.\|....?..Y..w.x..\|...F..y:.>'..z...g..J<~.a...~....].h.U..w..c,c.....1....e......].2.L..\|.......a............uM..8J...V:.-:.......q...u../._.~..v..d/.0?..m^....sL...4..

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	667
Entropy (8bit):	5.259437698800801
Encrypted:	false
SSDEEP:	12:tr/BWGuCtNIe/nL6t7MGZLWRRlV2LGXnCqjhll4XMRYBc4HxNNcGMXGrDPGGA:tzBXuENLLY7dLWRbsLACqjhllafBNHxk
MD5:	A132F48F1BA50AB81AC2011874827C7C
SHA1:	700CE9732FC5F4AB0724A69181836C095FFEE4C8
SHA-256:	BC24C19D990961C31F220CDB0DCB5D364E46F0F1C2682102591FCD9D478B32DC
SHA-512:	E4803F11169D8790B4DD3DF0834736BAE4B2265214562B9A5560CDEF6DD5D6F0AA0AA673EA64D505808F9B27A9875BF7FCB3EB5A4E2A9C145FCFE47705CC1336
Malicious:	false
Reputation:	low
URL:	https://zipwp.com/images/lock-icon.svg
Preview:	<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M22 14V9C22 5.68629 19.3137 3 16 3C12.6863 3 10 5.68629 10 9V14M9 29H23C24.6569 29 26 27.6569 26 26V17C26 15.3431 24.6569 14 23 14H9C7.34315 14 6 15.3431 6 17V26C6 27.6569 7.34315 29 9 29Z" stroke="url(#paint0_linear_19217_22462)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>.<defs>.<linearGradient id="paint0_linear_19217_22462" x1="6" y1="16" x2="26" y2="16" gradientUnits="userSpaceOnUse">.<stop stop-color="#B809A7"/>.<stop offset="0.46875" stop-color="#E90B76"/>.<stop offset="1" stop-color="#FC8536"/>.</linearGradient>.</defs>.</svg>.

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	5606
Entropy (8bit):	4.1592778340450405
Encrypted:	false
SSDEEP:	96:sn5wFUtF2cAuFiWrFc/YpRuGudwIPyOSX3AHb:sn5wGt8cAuFbrFmMRuGuxPylX3c
MD5:	9B150330301E502BD58FC5B795902F66
SHA1:	59559C92C5EA91A99B3B288B79C114B8D411B50A
SHA-256:	89F57C0D9E14EB55394A7C5E24FCE9519F56C325267766A1FC3B3847938FE103
SHA-512:	B1E4131FC30FC81CDB18D4DC0A05ADDD6383065A2F5AD99F1B14B9A48364466FE2BC2547DDD52B2649BB9CCC71939FE57DBFF07000DD783A627B1C9F5E679BDE
Malicious:	false
Reputation:	low
URL:	https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Verification</title>. <style type="text/css">. body {. margin: 0;. }. .zipwp-container {. width: 100%;. }.. .zipwp-row {. display: flex;. }.. .zipwp-image {. width: 100%;. height: 100vh;. background-image: url( "https://zipwp.com/images/site-image.png" );. background-size: cover;. background-position: center center;. }.. .zipwp-password-icon {. width: 32px;. height: 32px;. }.. .zipwp-content {. width: 48%;. background-color: #fff;. padding: 2rem;. display: flex;. flex-direction: column;. align-items: center;. font-family: Figtree, sans-serif;. }.. .zipwp-login

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1200 x 1080, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	938994
Entropy (8bit):	7.990755330865723
Encrypted:	true
SSDEEP:	24576:wbae0EpqD+27Feoj8RA3z3lfYh+1MeKlGw5m1:KaTf+2JcAjVfc+1MeKln5S
MD5:	364120324661D7263C4B6DEEA15F9ADE
SHA1:	2CDC7A50695B8738C62BBD560535885CF90334CB
SHA-256:	07E79354AD059F0727D39A389C6EA9E870681A3D915DC5DCFDE9B2406F218068
SHA-512:	F3A02377260FD06030BCA53D01918778A18B091124D5699AB67571851BE9E57DC7AC84B697882A9364D7CCE047981761305EC92FED9D880021B65BE8D54A8AF0
Malicious:	false
Reputation:	low
URL:	https://zipwp.com/images/site-image.png
Preview:	.PNG........IHDR.......8.......%z....pHYs.................sRGB.........gAMA......a...S.IDATx...k.#..-..&E.u.._=....{Ue..-.....&.8...L.If\|. ..IP.....k.N.3...x&K..o.].{.cK.xv....3..]......Y...+.c..%.R>\|G[....a..:?=.E9-.,y.....s........8.l.g...1...o..J..^.3............^0..ZcxM....x,c'..w..J...\|...8b........y.'.}...FF;oz.m......3..x.^.......8...0...M.G..}.:...?.~.....K....\|.i0.r.\|.............n.......8.0.l..<....q..Bsc::V....^./.^M...a....c,......z......<,..v..e..}.:o..Z...\..N.Q7jN.x...;:\a.4....\|.+.......{..\|?.?&^....4...5...u...1..~..1.0V....p.)..x.,u.\..m.O.n._T...<r......JMkC...............K.........C........:.....b..z..96c~KI...t.]..\|..M:Q....4....=iX.G.w..y/.r....}k.F...?....-...m.e.....0&....u...k....R^o.=........s..s...}.z.%...w.17.;......m.G{....z.cb......z.G.y.o.l.?..x\|.\|....?..Y..w.x..\|...F..y:.>'..z...g..J<~.a...~....].h.U..w..c,c.....1....e......].2.L..\|.......a............uM..8J...V:.-:.......q...u../._.~..v..d/.0?..m^....sL...4..

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HuKxIn:Od
MD5:	B945405A7A318AFB3B93AFFADC4FD978
SHA1:	798253494061EB1B723D1CF033DEE6DFCD65C839
SHA-256:	71BBB2B9C261452AC047D5212D12FD152D82F642B7960D2E0BF239FA6C970AD1
SHA-512:	85826B7066C7C362245FFCEF4F1C1D70501D82DCA077EA62F830988353AD6140337C733AAF916894EE23D230A395E1989B52DE7ED888CEB09F59CF12544495C1
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA5LjAuNTQxNC4xMjASEAla-WRUTpCInRIFDdD9Mwc=?alt=proto
Preview:	CgkKBw3Q/TMHGgA=

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5606
Entropy (8bit):	4.1592778340450405
Encrypted:	false
SSDEEP:	96:sn5wFUtF2cAuFiWrFc/YpRuGudwIPyOSX3AHb:sn5wGt8cAuFbrFmMRuGuxPylX3c
MD5:	9B150330301E502BD58FC5B795902F66
SHA1:	59559C92C5EA91A99B3B288B79C114B8D411B50A
SHA-256:	89F57C0D9E14EB55394A7C5E24FCE9519F56C325267766A1FC3B3847938FE103
SHA-512:	B1E4131FC30FC81CDB18D4DC0A05ADDD6383065A2F5AD99F1B14B9A48364466FE2BC2547DDD52B2649BB9CCC71939FE57DBFF07000DD783A627B1C9F5E679BDE
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Verification</title>. <style type="text/css">. body {. margin: 0;. }. .zipwp-container {. width: 100%;. }.. .zipwp-row {. display: flex;. }.. .zipwp-image {. width: 100%;. height: 100vh;. background-image: url( "https://zipwp.com/images/site-image.png" );. background-size: cover;. background-position: center center;. }.. .zipwp-password-icon {. width: 32px;. height: 32px;. }.. .zipwp-content {. width: 48%;. background-color: #fff;. padding: 2rem;. display: flex;. flex-direction: column;. align-items: center;. font-family: Figtree, sans-serif;. }.. .zipwp-login

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	667
Entropy (8bit):	5.259437698800801
Encrypted:	false
SSDEEP:	12:tr/BWGuCtNIe/nL6t7MGZLWRRlV2LGXnCqjhll4XMRYBc4HxNNcGMXGrDPGGA:tzBXuENLLY7dLWRbsLACqjhllafBNHxk
MD5:	A132F48F1BA50AB81AC2011874827C7C
SHA1:	700CE9732FC5F4AB0724A69181836C095FFEE4C8
SHA-256:	BC24C19D990961C31F220CDB0DCB5D364E46F0F1C2682102591FCD9D478B32DC
SHA-512:	E4803F11169D8790B4DD3DF0834736BAE4B2265214562B9A5560CDEF6DD5D6F0AA0AA673EA64D505808F9B27A9875BF7FCB3EB5A4E2A9C145FCFE47705CC1336
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M22 14V9C22 5.68629 19.3137 3 16 3C12.6863 3 10 5.68629 10 9V14M9 29H23C24.6569 29 26 27.6569 26 26V17C26 15.3431 24.6569 14 23 14H9C7.34315 14 6 15.3431 6 17V26C6 27.6569 7.34315 29 9 29Z" stroke="url(#paint0_linear_19217_22462)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>.<defs>.<linearGradient id="paint0_linear_19217_22462" x1="6" y1="16" x2="26" y2="16" gradientUnits="userSpaceOnUse">.<stop stop-color="#B809A7"/>.<stop offset="0.46875" stop-color="#E90B76"/>.<stop offset="1" stop-color="#FC8536"/>.</linearGradient>.</defs>.</svg>.

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	5606
Entropy (8bit):	4.1592778340450405
Encrypted:	false
SSDEEP:	96:sn5wFUtF2cAuFiWrFc/YpRuGudwIPyOSX3AHb:sn5wGt8cAuFbrFmMRuGuxPylX3c
MD5:	9B150330301E502BD58FC5B795902F66
SHA1:	59559C92C5EA91A99B3B288B79C114B8D411B50A
SHA-256:	89F57C0D9E14EB55394A7C5E24FCE9519F56C325267766A1FC3B3847938FE103
SHA-512:	B1E4131FC30FC81CDB18D4DC0A05ADDD6383065A2F5AD99F1B14B9A48364466FE2BC2547DDD52B2649BB9CCC71939FE57DBFF07000DD783A627B1C9F5E679BDE
Malicious:	false
Reputation:	low
URL:	https://lawful-lamontagne-7e83y.zipwp.top/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Verification</title>. <style type="text/css">. body {. margin: 0;. }. .zipwp-container {. width: 100%;. }.. .zipwp-row {. display: flex;. }.. .zipwp-image {. width: 100%;. height: 100vh;. background-image: url( "https://zipwp.com/images/site-image.png" );. background-size: cover;. background-position: center center;. }.. .zipwp-password-icon {. width: 32px;. height: 32px;. }.. .zipwp-content {. width: 48%;. background-color: #fff;. padding: 2rem;. display: flex;. flex-direction: column;. align-items: center;. font-family: Figtree, sans-serif;. }.. .zipwp-login

Static File Info

⊘No static file info

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 371
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 15:14:26.905406952 CET	49172	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:14:26.905455112 CET	443	49172	142.250.176.196	192.168.2.22
Mar 25, 2025 15:14:26.905507088 CET	49172	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:14:26.906687021 CET	49172	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:14:26.906708002 CET	443	49172	142.250.176.196	192.168.2.22
Mar 25, 2025 15:14:27.117512941 CET	443	49172	142.250.176.196	192.168.2.22
Mar 25, 2025 15:14:27.117588043 CET	49172	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:14:27.120543003 CET	49172	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:14:27.120558977 CET	443	49172	142.250.176.196	192.168.2.22
Mar 25, 2025 15:14:27.120867968 CET	443	49172	142.250.176.196	192.168.2.22
Mar 25, 2025 15:14:27.328325987 CET	443	49172	142.250.176.196	192.168.2.22
Mar 25, 2025 15:14:27.328419924 CET	49172	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:14:30.122900963 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.122931957 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.123009920 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.123465061 CET	49174	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.123501062 CET	443	49174	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.123651028 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.123667002 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.123675108 CET	49174	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.123776913 CET	49174	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.123789072 CET	443	49174	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.628150940 CET	443	49174	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.628220081 CET	49174	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.629767895 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.629828930 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.647501945 CET	49174	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.647527933 CET	443	49174	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.647770882 CET	443	49174	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.650684118 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.650701046 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.651331902 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.657373905 CET	49174	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.704276085 CET	443	49174	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.849140882 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.961026907 CET	443	49174	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.961050987 CET	443	49174	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.961105108 CET	49174	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.961128950 CET	443	49174	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.962165117 CET	49174	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:30.962202072 CET	443	49174	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:30.962249994 CET	49174	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:31.128422022 CET	49175	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.128463030 CET	443	49175	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.128525972 CET	49175	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.128562927 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.128590107 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.128639936 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.129044056 CET	49175	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.129060984 CET	443	49175	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.129234076 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.129245043 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.351068020 CET	443	49175	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.351207018 CET	49175	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.352283001 CET	49175	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.352293015 CET	443	49175	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.352530956 CET	443	49175	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.352973938 CET	49175	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.353362083 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.353429079 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.354347944 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.354353905 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.354551077 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.354811907 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.396281004 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.396281958 CET	443	49175	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.611202955 CET	443	49175	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.611320019 CET	443	49175	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.611623049 CET	49175	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.613068104 CET	49175	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.613086939 CET	443	49175	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.623878956 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.623912096 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.623970985 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.624011040 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.624025106 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625001907 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625027895 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625066042 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625075102 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625094891 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.625096083 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625102997 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625121117 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.625137091 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.625585079 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625629902 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625653982 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625674009 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625694990 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.625704050 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.625768900 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.625880003 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.626014948 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.626065016 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.626117945 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.626132965 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.626138926 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.626184940 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.626190901 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.627688885 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.627711058 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.627757072 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.627758026 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.627767086 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.627796888 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.627810955 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.627816916 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.627847910 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.628834963 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.628873110 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.628897905 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.628918886 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.628940105 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.628947020 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.628982067 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.628998041 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.629004002 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.629045963 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.629057884 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.629065037 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.629134893 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.629767895 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.629820108 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.629826069 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.629923105 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.629970074 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.629975080 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.733702898 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.733726978 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.733827114 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.733827114 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.733840942 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.734281063 CET	49178	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:31.734327078 CET	443	49178	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:31.734419107 CET	49178	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:31.734652042 CET	49178	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:31.734671116 CET	443	49178	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:31.900826931 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.900862932 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.900872946 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.900892973 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.900897026 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.900902033 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.900918961 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.900926113 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.900943995 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.900971889 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.900979996 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.900991917 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.900991917 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901000977 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901010036 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901031971 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901034117 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901042938 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901045084 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901065111 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901076078 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901084900 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901084900 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901114941 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901124001 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901125908 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901153088 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901163101 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901184082 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901191950 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901191950 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901191950 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901199102 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901221037 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901235104 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901261091 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901273012 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901277065 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901287079 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901298046 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901320934 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901348114 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901366949 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901366949 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901371956 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:31.901439905 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.901439905 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:31.948026896 CET	443	49178	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:31.948095083 CET	49178	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:31.948594093 CET	49178	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:31.948606968 CET	443	49178	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:31.948811054 CET	443	49178	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:31.949299097 CET	49178	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:31.992279053 CET	443	49178	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:32.006228924 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.006273031 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.006299973 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.006330967 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.006330967 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.006345034 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.006362915 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.006886959 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.007236958 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.007308006 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.007457018 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.007607937 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.007627010 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.007632017 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.007684946 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.008518934 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.008596897 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.008603096 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.008690119 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.008827925 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.008833885 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.009321928 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.009346962 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.009418964 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.009418964 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.009424925 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.010575056 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.010607958 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.010658026 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.010658026 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.010663986 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.011019945 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.011107922 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.011317968 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.011317968 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.011324883 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.012466908 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.012490988 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.012537003 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.012542963 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.012576103 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.113842010 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.113882065 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.113919020 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.113919020 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.113925934 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.114912033 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.114964008 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.114975929 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.115567923 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.115691900 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.115698099 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.116339922 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.116457939 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.116462946 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.117953062 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.117965937 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.117991924 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.118031025 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.118040085 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.118843079 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.118864059 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.118884087 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.118891954 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.118901014 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.118937969 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.119915962 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.119930029 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.120060921 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.120060921 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.120068073 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.120342970 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.120364904 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.120573997 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.120573997 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.120573997 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.120580912 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.126888990 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.126903057 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.126954079 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.126960993 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.127398968 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.127505064 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.127521038 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.127597094 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.127603054 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.127687931 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.127748966 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.127769947 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.127804041 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.127808094 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.127926111 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.128118992 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.128503084 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.128518105 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.128566980 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.128572941 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.128674030 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.230709076 CET	443	49178	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:32.230808020 CET	443	49178	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:32.230998993 CET	49178	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:32.232114077 CET	49178	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:32.232140064 CET	443	49178	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:32.291805029 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.291830063 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.291884899 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.291888952 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.291901112 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.291918039 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.291929960 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.291943073 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.291946888 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.291965961 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.291980028 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.291997910 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292020082 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292036057 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292036057 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292040110 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292053938 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292093039 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292105913 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292108059 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292108059 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292114973 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292157888 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292176008 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292176962 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292212009 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292217016 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292227030 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292228937 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292236090 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292287111 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292306900 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292319059 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292319059 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292325020 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292336941 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292354107 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292367935 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292409897 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292413950 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292413950 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292421103 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292437077 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292448044 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292463064 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292468071 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292479038 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292493105 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292494059 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292536020 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292552948 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292552948 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292552948 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292563915 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292579889 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292604923 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292618990 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292658091 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292658091 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292660952 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292671919 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292685032 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292687893 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292736053 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292758942 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292758942 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292828083 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292828083 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292834997 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292901993 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292933941 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292949915 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292954922 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292973042 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.292984962 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.292999029 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.293024063 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.293040991 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.293046951 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.293061018 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.294681072 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.409874916 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.409900904 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.409953117 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.409955025 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.409965992 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.409985065 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410047054 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410067081 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410067081 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410067081 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410067081 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410075903 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410090923 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410103083 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410120964 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410120964 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410123110 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410154104 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410154104 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410154104 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410159111 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410166979 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410176039 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410212994 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410229921 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410244942 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410244942 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410268068 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410271883 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410280943 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410311937 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410327911 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410362005 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410375118 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410375118 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410379887 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410394907 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410406113 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410409927 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410409927 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410409927 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410444021 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410476923 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410478115 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410482883 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410507917 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410518885 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410518885 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410521984 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410538912 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410556078 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410574913 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410586119 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410593987 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410628080 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410628080 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410634995 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410645008 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410657883 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410665989 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410670996 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410686970 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410706997 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410706997 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410706997 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410707951 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410717010 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.410747051 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410747051 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.410928965 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.500566959 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.500591993 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.500644922 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.500657082 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.500669003 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.500675917 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.500700951 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.500710011 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.500715017 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.500720978 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.500752926 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.500782013 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.500782967 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.500794888 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.500833035 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.500837088 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.500837088 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.500905037 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.501379967 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.501431942 CET	49176	443	192.168.2.22	104.26.1.180
Mar 25, 2025 15:14:32.501442909 CET	443	49176	104.26.1.180	192.168.2.22
Mar 25, 2025 15:14:32.546772957 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:32.583086014 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:32.583120108 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:32.583177090 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:32.592278004 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:32.593245983 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:32.593266010 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:32.731390953 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:32.734035969 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:32.734081030 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:32.734133959 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:32.734153986 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:32.734205008 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:32.734251976 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:32.734318018 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:32.735129118 CET	49173	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:32.735141993 CET	443	49173	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:32.816685915 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:32.840106964 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:32.840133905 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:32.840262890 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:32.840277910 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:32.893552065 CET	49180	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:32.893593073 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:32.893704891 CET	49180	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:33.012444019 CET	49181	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:33.012492895 CET	443	49181	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:33.012557030 CET	49181	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:33.095972061 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.096013069 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.096051931 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.096072912 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.096107006 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.096242905 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.096277952 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.096282959 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.096292973 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.096327066 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.096333027 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.097187042 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.097331047 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.097359896 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.097378969 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.097385883 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.098192930 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.098226070 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.098232985 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.098239899 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.098274946 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.098313093 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.098320961 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.099225998 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.099313021 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.099339962 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.099354982 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.099361897 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.099924088 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.099951982 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.099961042 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.099967957 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.100007057 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.100071907 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.100089073 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.179939032 CET	49180	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:33.179963112 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:33.201428890 CET	49181	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:33.201461077 CET	443	49181	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:33.204018116 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.209558964 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209616899 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209647894 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209669113 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.209676981 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209688902 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209724903 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.209737062 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209774971 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209805012 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209829092 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209841967 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.209850073 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209881067 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209909916 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209920883 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.209928036 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.209963083 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.209969997 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210004091 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210036039 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210043907 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210072994 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210079908 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210087061 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.210105896 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210117102 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.210124969 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210161924 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210172892 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.210180044 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210203886 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.210206985 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.210243940 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.210251093 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.287517071 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.287563086 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.317064047 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.317078114 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.317123890 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.317145109 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.317154884 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.317159891 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.317163944 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.317193031 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.317203045 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.317209005 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.317243099 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.317249060 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.317261934 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.317289114 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.318000078 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318046093 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.318056107 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318116903 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318150043 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.318157911 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318176031 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318205118 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318209887 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.318217993 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318248987 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.318528891 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318572044 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.318717957 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318767071 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.318886042 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318924904 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318933964 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.318939924 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318959951 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.318967104 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.318989038 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.319000959 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.319006920 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.319029093 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.319037914 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.319076061 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.319082022 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.321877003 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.422760963 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.422991037 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.423089027 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.423121929 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.423146963 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.423151016 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.423160076 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.423173904 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.423197985 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.423885107 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.423932076 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.423944950 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.423985004 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.424046993 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.424087048 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.424643993 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.424681902 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.424691916 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.424704075 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.424715996 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.424719095 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.424756050 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.424761057 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425331116 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425357103 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425379038 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.425384998 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425395966 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.425437927 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425477028 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.425481081 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425493002 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425523996 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.425528049 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425553083 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425564051 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.425570011 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425580025 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425592899 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.425606012 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.425633907 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.425643921 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.561786890 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.561811924 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.561834097 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.561925888 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.561933994 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.561944008 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.561969995 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.561979055 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.562043905 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.574193001 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.574198961 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.574228048 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.574419022 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.574419022 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.574419022 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.579988003 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.579996109 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.580013037 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.580105066 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580133915 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580210924 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580213070 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.580225945 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.580286026 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580319881 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580480099 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580482960 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.580499887 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.580569029 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580569029 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580600977 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580602884 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.580615044 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.580672026 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580708027 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580744028 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580746889 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.580835104 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.580867052 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664541006 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664565086 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664607048 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664613008 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664623022 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664628029 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664640903 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664649010 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664659977 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664670944 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664685011 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664691925 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664695024 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664711952 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664737940 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664745092 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664753914 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664753914 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664777994 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664793015 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664799929 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664814949 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664817095 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664824963 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.664834976 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.664854050 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.667139053 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.667145014 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.667176008 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.667191982 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.667344093 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.689336061 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:33.689415932 CET	49180	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:33.694483995 CET	49180	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:33.694490910 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:33.694878101 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:33.695357084 CET	49180	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:33.699172020 CET	443	49181	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:33.699238062 CET	49181	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:33.699711084 CET	49181	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:33.699717999 CET	443	49181	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:33.699951887 CET	443	49181	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:33.740262032 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:33.750751972 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.750771999 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.750804901 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.750813961 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.750833035 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.751806021 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.752281904 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.752306938 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.752326012 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.752331972 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.752342939 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.752346039 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.752372026 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.752372026 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.752383947 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.752394915 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.752413034 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.753458977 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.754188061 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.754209042 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.754250050 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.754256964 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.754270077 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.754457951 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.754632950 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.754648924 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.754687071 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.754693031 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.754906893 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.755965948 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.755983114 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.756015062 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.756021023 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.756032944 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.756330013 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.757029057 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.757044077 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.757078886 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.757110119 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.757128000 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.757143974 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.757183075 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.757183075 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.757183075 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.757183075 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.757210970 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.757241964 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.757246971 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.757275105 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.757280111 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.757288933 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.758256912 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.758264065 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.758281946 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.758356094 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.758392096 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.758392096 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.758514881 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.758696079 CET	49179	443	192.168.2.22	104.26.0.180
Mar 25, 2025 15:14:33.758706093 CET	443	49179	104.26.0.180	192.168.2.22
Mar 25, 2025 15:14:33.900859118 CET	49181	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:34.031874895 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:34.031944990 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:34.032011032 CET	49180	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:34.032037020 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:34.032093048 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:34.032169104 CET	49180	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:34.033114910 CET	49180	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:34.033130884 CET	443	49180	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:37.113584042 CET	443	49172	142.250.176.196	192.168.2.22
Mar 25, 2025 15:14:37.113655090 CET	443	49172	142.250.176.196	192.168.2.22
Mar 25, 2025 15:14:37.113845110 CET	49172	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:14:37.212263107 CET	49172	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:14:37.212301016 CET	443	49172	142.250.176.196	192.168.2.22
Mar 25, 2025 15:14:53.527189016 CET	443	49181	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:53.527364016 CET	443	49181	148.135.1.141	192.168.2.22
Mar 25, 2025 15:14:53.527426958 CET	49181	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:55.213058949 CET	49181	443	192.168.2.22	148.135.1.141
Mar 25, 2025 15:14:55.213092089 CET	443	49181	148.135.1.141	192.168.2.22
Mar 25, 2025 15:15:26.853018999 CET	49183	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:15:26.853060007 CET	443	49183	142.250.176.196	192.168.2.22
Mar 25, 2025 15:15:26.853140116 CET	49183	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:15:26.853331089 CET	49183	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:15:26.853343964 CET	443	49183	142.250.176.196	192.168.2.22
Mar 25, 2025 15:15:27.055247068 CET	443	49183	142.250.176.196	192.168.2.22
Mar 25, 2025 15:15:27.055737972 CET	49183	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:15:27.055757999 CET	443	49183	142.250.176.196	192.168.2.22
Mar 25, 2025 15:15:37.091494083 CET	443	49183	142.250.176.196	192.168.2.22
Mar 25, 2025 15:15:37.091643095 CET	443	49183	142.250.176.196	192.168.2.22
Mar 25, 2025 15:15:37.091734886 CET	49183	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:15:37.214843035 CET	49183	443	192.168.2.22	142.250.176.196
Mar 25, 2025 15:15:37.214871883 CET	443	49183	142.250.176.196	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 15:14:22.336054087 CET	53	54821	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:22.427572012 CET	53	52781	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:23.817672014 CET	53	62672	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:26.792819977 CET	64928	53	192.168.2.22	8.8.8.8
Mar 25, 2025 15:14:26.794363022 CET	57390	53	192.168.2.22	8.8.8.8
Mar 25, 2025 15:14:26.896696091 CET	53	64928	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:26.899075031 CET	53	57390	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:29.799716949 CET	54261	53	192.168.2.22	8.8.8.8
Mar 25, 2025 15:14:29.801562071 CET	60507	53	192.168.2.22	8.8.8.8
Mar 25, 2025 15:14:29.928333998 CET	53	60507	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:30.117537022 CET	53	54261	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:30.979655981 CET	55939	53	192.168.2.22	8.8.8.8
Mar 25, 2025 15:14:30.979942083 CET	49608	53	192.168.2.22	8.8.8.8
Mar 25, 2025 15:14:31.111289978 CET	53	55939	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:31.124581099 CET	53	49608	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:31.160628080 CET	53	62453	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:31.618243933 CET	61467	53	192.168.2.22	8.8.8.8
Mar 25, 2025 15:14:31.618381023 CET	61618	53	192.168.2.22	8.8.8.8
Mar 25, 2025 15:14:31.729614019 CET	53	61618	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:31.733642101 CET	53	61467	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:32.741981983 CET	52074	53	192.168.2.22	8.8.8.8
Mar 25, 2025 15:14:32.742090940 CET	50337	53	192.168.2.22	8.8.8.8
Mar 25, 2025 15:14:32.862981081 CET	53	52074	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:32.912220001 CET	53	50337	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:40.862359047 CET	53	51870	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:47.899920940 CET	53	65084	8.8.8.8	192.168.2.22
Mar 25, 2025 15:14:58.852910042 CET	53	49949	8.8.8.8	192.168.2.22
Mar 25, 2025 15:15:16.486598015 CET	53	54615	8.8.8.8	192.168.2.22
Mar 25, 2025 15:15:22.232940912 CET	53	53112	8.8.8.8	192.168.2.22

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 25, 2025 15:14:32.912951946 CET	192.168.2.22	8.8.8.8	d06c	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 25, 2025 15:14:26.792819977 CET	192.168.2.22	8.8.8.8	0x91d2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:26.794363022 CET	192.168.2.22	8.8.8.8	0x42d5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 25, 2025 15:14:29.799716949 CET	192.168.2.22	8.8.8.8	0xb634	Standard query (0)	lawful-lamontagne-7e83y.zipwp.top	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:29.801562071 CET	192.168.2.22	8.8.8.8	0x8c7b	Standard query (0)	lawful-lamontagne-7e83y.zipwp.top	65	IN (0x0001)	false
Mar 25, 2025 15:14:30.979655981 CET	192.168.2.22	8.8.8.8	0xb793	Standard query (0)	zipwp.com	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:30.979942083 CET	192.168.2.22	8.8.8.8	0x47aa	Standard query (0)	zipwp.com	65	IN (0x0001)	false
Mar 25, 2025 15:14:31.618243933 CET	192.168.2.22	8.8.8.8	0x93e4	Standard query (0)	zipwp.com	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:31.618381023 CET	192.168.2.22	8.8.8.8	0x93ae	Standard query (0)	zipwp.com	65	IN (0x0001)	false
Mar 25, 2025 15:14:32.741981983 CET	192.168.2.22	8.8.8.8	0xd8d2	Standard query (0)	lawful-lamontagne-7e83y.zipwp.top	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:32.742090940 CET	192.168.2.22	8.8.8.8	0x6120	Standard query (0)	lawful-lamontagne-7e83y.zipwp.top	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 25, 2025 15:14:26.896696091 CET	8.8.8.8	192.168.2.22	0x91d2	No error (0)	www.google.com	142.250.176.196	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:26.899075031 CET	8.8.8.8	192.168.2.22	0x42d5	No error (0)	www.google.com		65	IN (0x0001)	false
Mar 25, 2025 15:14:30.117537022 CET	8.8.8.8	192.168.2.22	0xb634	No error (0)	lawful-lamontagne-7e83y.zipwp.top	148.135.1.141	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:31.111289978 CET	8.8.8.8	192.168.2.22	0xb793	No error (0)	zipwp.com	104.26.1.180	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:31.111289978 CET	8.8.8.8	192.168.2.22	0xb793	No error (0)	zipwp.com	172.67.72.169	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:31.111289978 CET	8.8.8.8	192.168.2.22	0xb793	No error (0)	zipwp.com	104.26.0.180	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:31.124581099 CET	8.8.8.8	192.168.2.22	0x47aa	No error (0)	zipwp.com		65	IN (0x0001)	false
Mar 25, 2025 15:14:31.729614019 CET	8.8.8.8	192.168.2.22	0x93ae	No error (0)	zipwp.com		65	IN (0x0001)	false
Mar 25, 2025 15:14:31.733642101 CET	8.8.8.8	192.168.2.22	0x93e4	No error (0)	zipwp.com	104.26.0.180	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:31.733642101 CET	8.8.8.8	192.168.2.22	0x93e4	No error (0)	zipwp.com	104.26.1.180	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:31.733642101 CET	8.8.8.8	192.168.2.22	0x93e4	No error (0)	zipwp.com	172.67.72.169	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:14:32.862981081 CET	8.8.8.8	192.168.2.22	0xd8d2	No error (0)	lawful-lamontagne-7e83y.zipwp.top	148.135.1.141	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

lawful-lamontagne-7e83y.zipwp.top

zipwp.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49174	148.135.1.141	443	936	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:14:30 UTC	706	OUT	GET /zipwp-login-67e2afa011731.php HTTP/1.1 Host: lawful-lamontagne-7e83y.zipwp.top Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-25 14:14:30 UTC	279	IN	HTTP/1.1 200 OK Server: nginx-rc Date: Tue, 25 Mar 2025 14:14:30 GMT Content-Type: text/html Content-Length: 5606 Last-Modified: Thu, 28 Nov 2024 12:32:31 GMT Connection: close Vary: Accept-Encoding ETag: "674862df-15e6" Content-Type: text/html Accept-Ranges: bytes
2025-03-25 14:14:30 UTC	5606	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Verification</title> <style type="text/css"> body { margin: 0; }

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49175	104.26.1.180	443	936	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:14:31 UTC	607	OUT	GET /images/lock-icon.svg HTTP/1.1 Host: zipwp.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://lawful-lamontagne-7e83y.zipwp.top/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-25 14:14:31 UTC	1111	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 14:14:31 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close CF-Ray: 925f03df19e1624e-EWR CF-Cache-Status: HIT Age: 21484 Cache-Control: max-age=2592000 ETag: W/"67375084-29b" Expires: Thu, 24 Apr 2025 08:16:27 GMT Last-Modified: Fri, 15 Nov 2024 13:45:40 GMT Vary: Accept-Encoding x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-runcache-type: srcache x-runcloud-srcache-fetch: BYPASS x-runcloud-srcache-store: BYPASS x-xss-protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eEuonB25Ko5CNPaVNmB3M8fEOYzWzJOkecEhhRdZtEyzPA6mZNmDtr%2FGdTDLPk4StrxMJyU4kxn8Glr%2BIfrm%2BZptPzQSSSoh%2FvhoJmttwsb9ZRD9oDwzT%2FMJKg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=104843&min_rtt=104676&rtt_var=22334&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1185&delivery_rate=35418&cwnd=248&unsent_bytes=0&cid=a93e7816e2c787bb&ts=274&x=0"
2025-03-25 14:14:31 UTC	258	IN	Data Raw: 32 39 62 0d 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 32 32 20 31 34 56 39 43 32 32 20 35 2e 36 38 36 32 39 20 31 39 2e 33 31 33 37 20 33 20 31 36 20 33 43 31 32 2e 36 38 36 33 20 33 20 31 30 20 35 2e 36 38 36 32 39 20 31 30 20 39 56 31 34 4d 39 20 32 39 48 32 33 43 32 34 2e 36 35 36 39 20 32 39 20 32 36 20 32 37 2e 36 35 36 39 20 32 36 20 32 36 56 31 37 43 32 36 20 31 35 2e 33 34 33 31 20 32 34 2e 36 35 36 39 20 31 34 20 32 33 20 31 34 48 39 43 37 2e 33 34 33 31 35 20 31 34 20 36 Data Ascii: 29b<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M22 14V9C22 5.68629 19.3137 3 16 3C12.6863 3 10 5.68629 10 9V14M9 29H23C24.6569 29 26 27.6569 26 26V17C26 15.3431 24.6569 14 23 14H9C7.34315 14 6
2025-03-25 14:14:31 UTC	416	IN	Data Raw: 2e 33 34 33 31 20 36 20 31 37 56 32 36 43 36 20 32 37 2e 36 35 36 39 20 37 2e 33 34 33 31 35 20 32 39 20 39 20 32 39 5a 22 20 73 74 72 6f 6b 65 3d 22 75 72 6c 28 23 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 31 39 32 31 37 5f 32 32 34 36 32 29 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 2f 3e 0a 3c 64 65 66 73 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 31 39 32 31 37 5f 32 32 34 36 32 22 20 78 31 3d 22 36 22 20 79 31 3d 22 31 36 22 20 78 32 3d 22 32 36 22 20 79 32 3d 22 31 36 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 Data Ascii: .3431 6 17V26C6 27.6569 7.34315 29 9 29Z" stroke="url(#paint0_linear_19217_22462)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/><defs><linearGradient id="paint0_linear_19217_22462" x1="6" y1="16" x2="26" y2="16" gradientUnits="userSp
2025-03-25 14:14:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49176	104.26.1.180	443	936	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:14:31 UTC	608	OUT	GET /images/site-image.png HTTP/1.1 Host: zipwp.com Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://lawful-lamontagne-7e83y.zipwp.top/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-25 14:14:31 UTC	1119	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 14:14:31 GMT Content-Type: image/png Content-Length: 938994 Connection: close CF-Ray: 925f03df28061dcc-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Age: 15628 Cache-Control: max-age=2592000 ETag: "67375084-e53f2" Expires: Thu, 24 Apr 2025 09:54:03 GMT Last-Modified: Fri, 15 Nov 2024 13:45:40 GMT Vary: Accept-Encoding x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-runcache-type: srcache x-runcloud-srcache-fetch: BYPASS x-runcloud-srcache-store: BYPASS x-xss-protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GMTD1oLea8Ob9RuhnMiNR3qCrkkMubHPvJnxDjA69hBCEb96aJHLDmf1VQg9k6LX8y8bv0hzL5yuwoQAA%2BajmgHZ1W7EiZkmagMfvwHEy3UlSOVV%2BLMISUKO5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=106256&min_rtt=105884&rtt_var=22902&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2819&recv_bytes=1186&delivery_rate=34806&cwnd=243&unsent_bytes=0&cid=1399f07dc3caac9b&ts=284&x=0"
2025-03-25 14:14:31 UTC	250	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 b0 00 00 04 38 08 06 00 00 00 19 c2 25 7a 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 0e 53 87 49 44 41 54 78 01 cc fd 6b 96 23 b9 8e 2d 0c 02 26 45 9e 75 bb bf 5f 3d 82 9e ff 00 7b 55 65 b8 0c 2d 12 d8 c0 06 8d 26 f7 38 8f ba c5 4c 0f 49 66 7c 80 20 88 17 49 50 ff cf ff e7 ff 6b f2 4e aa 2a 33 99 f9 c7 78 26 4b d2 cb 93 6f d3 5d 09 7b b7 63 4b bb 78 76 fc a4 9d c8 33 ca a0 0e 5d de e1 bd 7f a9 b6 f2 59 bd b8 ef 2b e1 63 e9 c0 25 bf 52 3e 7c 47 5b ba d6 a9 c7 cc 61 86 c7 3a 3f 3d bb 45 39 2d fc 2c 79 f1 8c 1e ca f2 e6 73 02 fc 0b dc fe a8 e3 0f 38 ce be 6c c6 67 f7 8c f1 ac bb Data Ascii: PNGIHDR8%zpHYssRGBgAMAaSIDATxk#-&Eu_={Ue-&8LIf\| IPkN*3x&Ko]{cKxv3]Y+c%R>\|G[a:?=E9-,ys8lg
2025-03-25 14:14:31 UTC	1369	IN	Data Raw: 31 89 e7 ba 1d 6f 15 8c 4a 8e af 5e cb 33 8c b7 a9 0f a5 80 ba 0b 97 fe bb ea b0 5e 30 da 2e 5a 63 78 4d ce d3 e4 f1 78 2c 63 27 97 b2 77 a0 e9 4a cb b3 80 03 7c 1c c7 ac f7 38 62 9c 82 8e 17 08 b2 fe f1 79 9e 27 b5 7d c5 fb 85 46 46 3b 6f 7a 1c 6d a9 be fb 12 df e7 33 ad f9 78 be 5e 01 cb b1 b0 02 9d f0 f9 38 bc f3 d9 99 30 1c c7 e3 4d ea 47 b6 ef 7d 8c 3a c6 fb f7 3f bf 7e fd 92 bf fe fa 4b 9e 87 d7 f3 7c 97 69 30 8f 72 ef 7c bf bf bc fd ff df 7f fd 97 fc fe fd f5 6e c7 f9 c5 eb 1c cf df 38 99 30 c8 6c fb 0c 3c 9c 16 a8 8c 71 f1 bf f3 42 73 63 3a 3a 56 b5 e1 ce e9 5e a2 2f c7 95 5e 4d b6 b8 f7 61 f4 fa d6 b6 1e 63 2c 81 ef c0 a5 c3 fd 7a f7 c5 cb f3 18 ae 3c 2c f9 84 76 da 19 65 aa 8f 7d ce 3a 6f f5 ff 5a 02 1b 08 5c ae fc 4e e9 87 51 37 6a 4e 2e 78 bc Data Ascii: 1oJ^3^0.ZcxMx,c'wJ\|8by'}FF;ozm3x^80MG}:?~K\|i0r\|n80l<qBsc::V^/^Mac,z<,ve}:oZ\NQ7jN.x
2025-03-25 14:14:31 UTC	1369	IN	Data Raw: 0f dc 4e 27 c5 5b 39 ff 7a cf f9 bf 1f 6f 03 fd 6d 88 fc f7 cb 3f 1f 61 bc 1c 63 a1 e0 75 06 67 d1 62 7b 39 7e d4 2a 2b 63 a1 5c 61 1e 32 ef 9c 46 9c 54 f9 52 c4 0a 59 4e 6f 5e 21 e6 33 f7 0f 2c f8 4e 09 ed 06 cd 4f 06 aa f7 83 0d 74 d5 8e d6 9e 77 99 ff c4 07 8d de 5f d5 0b ad 36 24 1c 56 f1 87 bc af 69 08 bd 02 1f e5 e0 82 13 f5 8c 56 86 e1 c4 c6 b2 06 de d8 09 3f 1d 5f 83 e9 4c 47 95 ca ef 00 f5 7c ff fe 7a 97 ff ef 51 f7 98 e7 a3 45 8b f6 e6 77 37 c2 ac 03 2f 65 80 e2 a9 f7 7b 98 4e 47 38 26 24 21 72 7e 77 44 71 5e d4 b1 98 eb 3a 1c 2b 09 ae 42 e0 a6 01 0b 07 17 f3 6e c8 e4 6c 67 e1 7b ac 3b 4d e7 39 39 bf f9 39 3b b4 e0 88 02 26 87 3c 4c fa 5c 12 78 fc 18 89 f3 0c 1e 49 3c 6f b7 58 00 83 72 d5 d3 d6 f9 01 e7 70 92 de 79 36 1d 76 7e 1e 85 83 e7 c3 ff Data Ascii: N'[9zom?acugb{9~*+c\a2FTRYNo^!3,NOtw_6$ViV?_LG\|zQEw7/e{NG8&$!r~wDq^:+Bnlg{;M999;&<L\xI<oXrpy6v~
2025-03-25 14:14:31 UTC	1369	IN	Data Raw: d3 03 07 e9 0e 02 dd 50 ba 81 9d ba 2c c1 d4 f4 77 71 07 bb 06 ae 20 bb 81 e7 75 07 e6 5d 82 0e 8f 19 85 ba a3 83 79 e2 a2 c6 f8 fd ff 19 f4 6a a1 8b a6 ce 8f d2 2e c3 93 67 98 c8 aa a1 ac 7d 95 9b 5f c3 b1 78 58 f5 0b 79 d0 df 43 8b 9b 4e 3a 92 d0 61 0f 8b 05 ee d3 e1 3c 03 d7 41 0c ec f8 c0 89 8c f1 fe 94 93 b1 2e 57 db ce ba 6d 41 b2 3d 61 de 2b 15 4b 1f ee 9f c1 c1 ca 38 07 4f 05 ad 88 f6 76 2c 70 8e ec b2 1b 76 ae ef 43 9a fd 83 de a7 05 93 2d f6 ea d6 59 c7 fc 6f c9 b5 d7 52 97 84 f6 4c 43 be 58 ab e5 ce 49 c8 e5 77 f8 6c 63 a4 c4 0f 0b b8 b0 ef 34 7f 33 9e d3 81 56 1d dd b6 fd dc 32 c1 50 26 c4 ee 11 70 c7 b8 2f c6 eb ee 5d d4 6d f2 89 d1 db 95 c9 15 dc 97 ef 6b 2d 7c 24 06 86 69 53 30 59 e9 40 7b a8 6f 15 46 04 8f 2e 78 01 43 69 f8 82 30 88 ef 46 Data Ascii: P,wq u]yj.g}_xXyCN:a<A.WmA=a+K8Ov,pvC-YoRLCXIwlc43V2P&p/]mk-\|$iS0Y@{oF.xCi0F
2025-03-25 14:14:31 UTC	1369	IN	Data Raw: 1d 72 a7 c6 a1 b4 55 fa 9a 80 ab 72 a8 95 f2 e6 8e c4 33 61 c3 7b 06 ed 58 8e b0 a0 2c fa c8 f0 af 7d e0 ef 2b 2e 3d 96 4b 1d 1d 98 c7 ef 54 d3 a1 34 85 0d 9d 76 56 12 8e bb 71 5b 15 a0 84 cb 5f ce a7 c6 6c 40 6b 77 e6 88 33 85 b8 4d c7 74 44 bd df 7c 09 09 8d 52 28 8e 43 69 15 35 98 d5 86 07 40 89 3f 70 8c 20 56 01 a6 c2 74 4a c6 32 e0 6d ee b3 0d f3 d8 07 d3 c0 8c 38 52 33 4f 74 6a e2 4b 5f 7e b8 2c e6 9b cf 79 49 65 a4 62 8a 85 a1 1a 2b ea 86 a0 59 da 95 ce 1a c3 33 c2 a2 58 29 49 88 a7 a0 e1 c8 13 99 f1 3d 3c ce c7 83 e8 0b f3 1b 4a e0 59 f3 24 76 3d 4c a7 e5 50 88 1f 15 ef 21 d7 40 26 1d 1c f2 f5 fb cb 0d 86 e7 73 d2 88 1b 97 57 07 16 f3 d2 26 9c e4 2a 5c 98 67 25 4d 88 c8 ad f8 da f1 c9 a5 ee 3b 19 01 67 12 e7 5f f3 8d 31 7e c4 ee 97 72 e0 7a 3b 19 Data Ascii: rUr3a{X,}+.=KT4vVq[_l@kw3MtD\|R(Ci5@?p VtJ2m8R3OtjK_~,yIeb+Y3X)I=<JY$v=LP!@&sW&*\g%M;g_1~rz;
2025-03-25 14:14:31 UTC	1369	IN	Data Raw: 90 79 f2 a5 42 f9 e7 93 7e fc b9 63 5e 53 b1 32 df 89 f3 f7 7b 1e fd d7 97 ca af af 43 fe fa d2 50 e8 87 62 fc 56 a4 c7 d9 66 0b cf 25 62 9b 68 97 dd 69 2c 6c 64 63 2a d1 c1 23 ae bc b5 2b 85 33 5f cc 19 9f 3f d2 14 2f 0f 5c 7e de d2 02 94 3c fd 34 9f ec 0a 83 b5 67 dd a9 ca f9 71 da 0f 86 a4 c6 0f 77 ca 7b 5f b0 79 a1 8e ff 61 d5 df cb f8 6e 20 6b f6 a5 65 20 60 97 01 70 ec 88 01 36 ad b8 57 93 3f ca dc 49 e5 3b a5 a6 44 18 eb 1c f2 f7 ac ef 4c 07 d6 df e2 ce ab 31 ce 2f 89 e3 82 e6 98 7d 9d 98 d7 84 18 eb 8a 6f ca 75 42 84 2d a8 4c 23 2d 7e 9f 89 50 6f c7 8f 52 c9 a2 cf 1e 39 67 93 5f c5 94 6a bc b3 00 2a 59 21 b2 95 db fe f8 ca 7f 76 ba 16 78 3c ef 1c e5 ba 72 fc 93 c7 79 cc 2b 1c 57 9f 32 85 8d ab 46 2f b6 a7 4d f9 94 88 1e 12 47 98 67 68 c7 77 5d 3d Data Ascii: yB~c^S2{CPbVf%bhi,ldc#+3_?/\~<4gqw{_yan ke `p6W?I;DL1/}ouB-L#-~PoR9g_jY!vx<ry+W2F/MGghw]=
2025-03-25 14:14:31 UTC	1369	IN	Data Raw: 12 27 b9 93 33 1a 3e 02 3a 48 16 38 2f 73 6e 10 87 2c 9d ad 83 66 f8 87 c8 3a 99 ab 36 b0 68 9c 96 4b 51 62 b7 a5 87 6d 70 a8 38 f0 fe e4 45 e7 99 f1 22 5d 56 bc 7c 97 66 09 28 b6 16 a4 ab 65 7b 7e d8 1c 58 4b aa 39 65 89 ef cb a7 10 bf 5e 70 f2 c9 36 bc d8 13 f4 fc 1b a9 b3 c8 66 ce 1f 34 1e c7 07 8d e1 46 fe e5 88 20 be 73 d8 03 e7 b9 ba 40 67 bd bd 95 35 69 87 27 e5 01 f2 b2 5e 73 53 76 7d c7 0b 2a b7 f9 e3 f7 b1 9c 53 db 3a e0 e8 39 d7 9d 0e 31 ab 76 79 dc 9e eb 2a 8d 32 87 ff a8 c5 f7 74 e9 c8 4e 30 e3 55 bc 37 fe 2d 35 41 7f d6 62 d5 69 2b ac 77 30 43 68 6c 84 4a 63 40 51 b1 2d d7 d7 5e 0c b0 95 81 8a 34 c1 b5 07 c5 f3 ee 9d 5c f8 ae 3b d0 b7 02 98 d3 27 58 d7 3c 9f 26 30 ea 58 cb 7d 57 66 85 df b3 ea 86 df 5b f6 a5 f2 71 79 b9 4e ee ec db 95 c9 31 Data Ascii: '3>:H8/sn,f:6hKQbmp8E"]V\|f(e{~XK9e^p6f4F s@g5i'^sSv}S:91vy2tN0U7-5Abi+w0ChlJc@Q-^4\;'X<&0X}Wf[qyN1
2025-03-25 14:14:31 UTC	1369	IN	Data Raw: 11 78 53 a5 68 63 06 d7 1d 5b c6 bf 42 b1 3f 80 4b cd db 09 31 b7 e6 ce 27 ed ce 8d 59 fd 58 65 d2 8a 21 72 4a c9 db 64 fc aa 3d 10 2d 14 08 18 16 03 47 e3 08 c5 f1 48 a3 02 c1 39 cf b8 a5 e5 71 fc 6a b7 65 cd ed ee 63 37 c9 e9 c1 6f 45 ea b6 1a 6f 3b ce ac cf e1 ae 2b dc e1 90 e1 bf 8f 29 04 c6 ee 79 10 c6 47 06 a3 37 df 5b 55 1b c3 eb 27 69 75 b8 c2 19 30 e3 9d e9 39 8d 1f ac e4 8f f7 33 ee 17 29 02 3e df 63 f7 08 8d 13 ea 63 03 be 1c 98 ce ab ae 7c d0 82 57 b0 22 6b 84 a6 9f 39 af 56 e3 31 0a 93 ce 9e 6a 49 b6 7b 97 92 87 a5 92 25 2b d3 6c 7c 20 cb c9 b5 6f 97 72 db 3e 2c 4c 48 64 91 b3 b6 79 fa 99 42 d2 5f ff 29 45 9e 49 df 51 e6 ef af f3 6d 0c bf 7c ce 1e e0 41 1e 77 e3 fc e5 38 fc 85 58 31 2a 71 63 a9 23 c9 e2 48 03 1b 64 6b ea bb 62 48 b6 99 64 6c Data Ascii: xShc[B?K1'YXe!rJd=-GH9qjec7oEo;+)yG7[U'iu093)>cc\|W"k9V1jI{%+l\| or>,LHdyB_)EIQm\|Aw8X1*qc#HdkbHdl
2025-03-25 14:14:31 UTC	1369	IN	Data Raw: 1f 91 ef 0c 69 16 fb 3d 5d 46 c3 b0 99 38 38 53 de 1d 01 87 a3 c9 be 9d 49 ac 8f 3c 10 f0 99 de 71 ca 23 fa 5a 4a 3f f3 a3 f1 7e a7 d3 dc f1 fc 74 4c 88 6c 75 04 aa a1 c3 4b 86 4b b2 15 a2 ff 19 f7 2a ff 42 b6 0f 07 d6 72 e3 20 82 cd 03 7e e8 0f 57 56 e1 f4 78 c6 4b c8 cb c7 03 3c fc 9f e1 39 94 5f 95 78 57 7f 4f aa 83 7c a7 3f 7f 7a c7 32 78 cd cf 45 ef 7a 71 2b a3 d6 72 17 1b 63 a9 4b af b5 97 fe 5d b5 f1 f4 61 db 61 67 af a4 ed 68 75 ac a9 6c d7 8d b3 e7 02 42 2e 7d 16 c0 b6 e2 c2 73 60 fe 62 a7 e1 c8 7e 82 7d 46 41 50 03 74 52 ec b8 7a 68 1c 23 54 8a 5d b5 cc 51 d6 4b 05 ba 06 2d 48 66 b9 1b 39 0b bd a2 78 0c cd 19 92 37 ba a3 4d 2d ce d7 f2 5b e7 88 bb 9d 57 16 3a 48 98 58 f9 87 85 95 33 e2 c5 62 d1 62 3f 37 b0 e0 02 60 74 79 5b 9f 0a 19 21 6e 03 f8 Data Ascii: i=]F88SI<q#ZJ?~tLluKK*Br ~WVxK<9_xWO\|?z2xEzq+rcK]aaghulB.}s`b~}FAPtRzh#T]QK-Hf9x7M-[W:HX3bb?7`ty[!n
2025-03-25 14:14:31 UTC	1369	IN	Data Raw: 0e 9e 3b 37 fc 6a 97 6e 75 1a a9 79 bd d2 7a c2 4a 8c 6b dd 75 86 cf 1d 0e da 8e b8 7a b8 02 20 b8 ab 37 eb d4 e5 f7 ae dc 7c f6 1d 02 3e 29 1c 3f 49 c1 40 18 d1 6a 1f 86 7b 11 d4 97 d7 9c c7 6c a5 23 14 e4 dc 91 d5 9a 92 d1 9b ec bb 7f d6 09 b3 1a 73 77 e0 a2 6d 16 9e dc 06 7f 96 70 75 a3 a6 bf 93 9b b6 f6 ef d9 a0 5b 1d 54 50 6e cb e9 03 51 71 15 8a 5e d7 da a6 c8 9e 82 6c 19 aa 75 f7 43 1f 19 c0 ce bb 57 50 6e a4 ae 84 c9 a5 1c 0c d1 15 96 8c 6b 23 30 6c 79 b5 c2 ae 3c 4e b4 5d 41 db 51 ba 1a e3 2b e7 b8 d2 ce ba 5a 57 86 2f 68 e9 13 8f 09 05 22 2c 9c c4 98 5e 9d cb 57 fa 91 b5 63 33 a5 b2 ab 15 37 e0 48 45 5c e6 f1 ad 38 ac 32 15 85 33 77 14 85 f3 08 c7 e7 68 67 53 c1 11 0e 2d f5 55 21 1d 75 85 f2 e9 4e 07 5f 2d c3 6d 56 a3 ae af e9 ac 79 d5 fc 33 cf Data Ascii: ;7jnuyzJkuz 7\|>)?I@j{l#swmpu[TPnQq^luCWPnk#0ly<N]AQ+ZW/h",^Wc37HE\823whgS-U!uN_-mVy3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49178	104.26.0.180	443	936	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:14:31 UTC	353	OUT	GET /images/lock-icon.svg HTTP/1.1 Host: zipwp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-25 14:14:32 UTC	1108	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 14:14:32 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close CF-Ray: 925f03e2d98e431a-EWR CF-Cache-Status: HIT Age: 21485 Cache-Control: max-age=2592000 ETag: W/"67375084-29b" Expires: Thu, 24 Apr 2025 08:16:27 GMT Last-Modified: Fri, 15 Nov 2024 13:45:40 GMT Vary: Accept-Encoding x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-runcache-type: srcache x-runcloud-srcache-fetch: BYPASS x-runcloud-srcache-store: BYPASS x-xss-protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CGvdJA%2Fjtxw9sozJZ%2FTdbey%2BIWDKAdx8pOpkmGNjGFdVnU%2BW31Q5e8uSSP3uqPDub3E0yHs62fO4tfnLIwN5NCNeY7UrhAqVGdqhjonP6LeLsEBTcW5furgAMg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=103036&min_rtt=102956&rtt_var=21841&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2819&recv_bytes=931&delivery_rate=36099&cwnd=248&unsent_bytes=0&cid=ee1faf3d1c1e5564&ts=287&x=0"
2025-03-25 14:14:32 UTC	261	IN	Data Raw: 32 39 62 0d 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 32 32 20 31 34 56 39 43 32 32 20 35 2e 36 38 36 32 39 20 31 39 2e 33 31 33 37 20 33 20 31 36 20 33 43 31 32 2e 36 38 36 33 20 33 20 31 30 20 35 2e 36 38 36 32 39 20 31 30 20 39 56 31 34 4d 39 20 32 39 48 32 33 43 32 34 2e 36 35 36 39 20 32 39 20 32 36 20 32 37 2e 36 35 36 39 20 32 36 20 32 36 56 31 37 43 32 36 20 31 35 2e 33 34 33 31 20 32 34 2e 36 35 36 39 20 31 34 20 32 33 20 31 34 48 39 43 37 2e 33 34 33 31 35 20 31 34 20 36 Data Ascii: 29b<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M22 14V9C22 5.68629 19.3137 3 16 3C12.6863 3 10 5.68629 10 9V14M9 29H23C24.6569 29 26 27.6569 26 26V17C26 15.3431 24.6569 14 23 14H9C7.34315 14 6
2025-03-25 14:14:32 UTC	413	IN	Data Raw: 33 31 20 36 20 31 37 56 32 36 43 36 20 32 37 2e 36 35 36 39 20 37 2e 33 34 33 31 35 20 32 39 20 39 20 32 39 5a 22 20 73 74 72 6f 6b 65 3d 22 75 72 6c 28 23 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 31 39 32 31 37 5f 32 32 34 36 32 29 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 2f 3e 0a 3c 64 65 66 73 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 31 39 32 31 37 5f 32 32 34 36 32 22 20 78 31 3d 22 36 22 20 79 31 3d 22 31 36 22 20 78 32 3d 22 32 36 22 20 79 32 3d 22 31 36 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 Data Ascii: 31 6 17V26C6 27.6569 7.34315 29 9 29Z" stroke="url(#paint0_linear_19217_22462)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/><defs><linearGradient id="paint0_linear_19217_22462" x1="6" y1="16" x2="26" y2="16" gradientUnits="userSpace
2025-03-25 14:14:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49173	148.135.1.141	443	936	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:14:32 UTC	652	OUT	GET /favicon.ico HTTP/1.1 Host: lawful-lamontagne-7e83y.zipwp.top Connection: keep-alive sec-ch-ua: "Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-25 14:14:32 UTC	279	IN	HTTP/1.1 200 OK Server: nginx-rc Date: Tue, 25 Mar 2025 14:14:32 GMT Content-Type: text/html Content-Length: 5606 Last-Modified: Thu, 28 Nov 2024 12:32:31 GMT Connection: close Vary: Accept-Encoding ETag: "674862df-15e6" Content-Type: text/html Accept-Ranges: bytes
2025-03-25 14:14:32 UTC	5606	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Verification</title> <style type="text/css"> body { margin: 0; }

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49179	104.26.0.180	443	936	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:14:32 UTC	354	OUT	GET /images/site-image.png HTTP/1.1 Host: zipwp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-25 14:14:33 UTC	1114	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 14:14:33 GMT Content-Type: image/png Content-Length: 938994 Connection: close CF-Ray: 925f03e85dc9c4fb-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Age: 15630 Cache-Control: max-age=2592000 ETag: "67375084-e53f2" Expires: Thu, 24 Apr 2025 09:54:03 GMT Last-Modified: Fri, 15 Nov 2024 13:45:40 GMT Vary: Accept-Encoding x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-runcache-type: srcache x-runcloud-srcache-fetch: BYPASS x-runcloud-srcache-store: BYPASS x-xss-protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=liTJ9sRSZ5ZSTesBcipgw6URMZBw7djyXQMx8kd7Pj730AhaKRTQW6yRaSpwpz57B2vq5qmKql9sfAFR92Ch68dl8rnekkK7FwRgj6rp7o1zjXMNXOsEwJrmzQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=107262&min_rtt=106358&rtt_var=23796&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2819&recv_bytes=932&delivery_rate=34145&cwnd=215&unsent_bytes=0&cid=cb0c7d41262cc238&ts=287&x=0"
2025-03-25 14:14:33 UTC	1369	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 b0 00 00 04 38 08 06 00 00 00 19 c2 25 7a 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 0e 53 87 49 44 41 54 78 01 cc fd 6b 96 23 b9 8e 2d 0c 02 26 45 9e 75 bb bf 5f 3d 82 9e ff 00 7b 55 65 b8 0c 2d 12 d8 c0 06 8d 26 f7 38 8f ba c5 4c 0f 49 66 7c 80 20 88 17 49 50 ff cf ff e7 ff 6b f2 4e aa 2a 33 99 f9 c7 78 26 4b d2 cb 93 6f d3 5d 09 7b b7 63 4b bb 78 76 fc a4 9d c8 33 ca a0 0e 5d de e1 bd 7f a9 b6 f2 59 bd b8 ef 2b e1 63 e9 c0 25 bf 52 3e 7c 47 5b ba d6 a9 c7 cc 61 86 c7 3a 3f 3d bb 45 39 2d fc 2c 79 f1 8c 1e ca f2 e6 73 02 fc 0b dc fe a8 e3 0f 38 ce be 6c c6 67 f7 8c f1 ac bb 31 89 e7 ba 1d Data Ascii: PNGIHDR8%zpHYssRGBgAMAaSIDATxk#-&Eu_={Ue-&8LIf\| IPkN*3x&Ko]{cKxv3]Y+c%R>\|G[a:?=E9-,ys8lg1
2025-03-25 14:14:33 UTC	1369	IN	Data Raw: 37 b0 08 a6 4f 69 35 36 9b 50 5d 61 f8 f0 fe 7f 32 ed e8 11 28 f2 cf 9f 72 89 fb fa bb 82 b0 1b c3 cf b5 9f 4c 6f c9 48 ed 76 4c 20 e4 4b 18 26 07 48 66 7c 37 0f 37 1d c0 97 fa 79 04 73 57 57 de 86 62 00 61 0a dc 69 13 34 16 4a 90 ba 51 65 a4 10 4c 63 f2 98 0e be 91 5e e7 97 2b 16 10 0e 53 c1 38 a6 52 31 1c 66 8f 50 bc 8e a9 24 b8 10 74 a3 74 30 e5 61 e0 bc 66 7b 13 86 54 08 1c 29 d3 51 36 da 0e 3c 18 f5 eb 53 52 9e e4 b6 0a bd ae 44 df 39 af 44 f6 74 0e 87 93 52 23 cf e7 83 04 1a d3 4a 28 12 3b e2 f9 01 83 5c 95 23 b4 7f eb bc 8a 26 d5 25 4a 39 b1 76 e9 07 a4 f4 13 e7 15 c3 ca 9f fc 9d f1 cf f3 01 ca 2b 1b 90 2a be 10 70 6d 43 db 3c d8 39 dc 60 a4 c3 a0 c3 58 5f eb 09 f8 44 3e e3 e8 ff 62 b2 9d 50 59 d3 bf 43 d0 fe 71 0a fe 64 07 01 51 34 0f dc 4e 27 c5 Data Ascii: 7Oi56P]a2(rLoHvL K&Hf\|77ysWWbai4JQeLc^+S8R1fP$tt0af{T)Q6<SRD9DtR#J(;\#&%J9v+*pmC<9`X_D>bPYCqdQ4N'
2025-03-25 14:14:33 UTC	1369	IN	Data Raw: af ce c0 e3 fd ca ab b4 e8 e2 fd 77 82 36 b4 8f 46 2a e7 c4 88 27 0f 17 da c1 37 69 c2 1d 04 ee ec 23 79 2c 85 ef 95 c7 81 87 8d dd c6 9d ef 74 1e 55 3b 42 8b df cc 4f 07 3d 60 38 a4 3b 97 4a 67 74 fe 48 ba 00 70 a0 35 8e 2c 93 e6 4e 2a 91 de 3f c2 9c 04 de 05 d2 fe 24 5a 4c aa 91 e4 cf 8f 87 2f d0 fc 1a bb 31 de dd 1a df 87 e3 6a 3c 9f ba c3 61 b9 cb 75 38 0a e7 ce ab 18 97 39 e5 c4 c2 71 a7 4c a0 d1 66 ed 06 d3 0d 5f eb 7a 59 e9 c8 39 7d b5 74 4e e8 07 a0 b3 a4 82 14 04 35 a6 eb 58 7e 32 8c af ed d3 b3 fc e7 2a 33 b5 c9 52 93 be 30 b6 d4 62 f5 e2 2a 15 ba ce 5c f0 81 34 5d c6 a4 fe 84 3c a9 fb 68 c1 1a 7c d4 d7 05 8b 77 8e 94 bb 69 18 48 1e 92 8b 3c e2 bc d2 3b 05 1a 1e 8b 1c 83 e7 84 de 37 db 23 d1 e4 f3 03 45 8b a7 82 ef 4a d2 be c3 86 d3 03 07 e9 0e Data Ascii: w6F'7i#y,tU;BO=`8;JgtHp5,N?$ZL/1j<au89qLf_zY9}tN5X~23R0b\4]<h\|wiH<;7#EJ
2025-03-25 14:14:33 UTC	1369	IN	Data Raw: 8f ca 5c 96 f8 62 f1 94 d4 a7 ef 2e 1b 76 80 9f 84 18 82 f3 71 91 6d dd 56 bd ea 50 17 fa 00 1e a9 2c f8 0e 70 5c fa 38 33 f6 de 56 e7 23 2a 44 c4 42 53 22 1b cd 7a 21 f3 45 af fd 90 d2 e3 2e c9 44 f6 ce 25 77 ce a8 e9 6d 5e 17 a1 26 05 5c 7c d5 ea 33 f7 17 34 ea 30 5b f6 a7 b7 7f 85 31 71 42 13 36 bf 93 4e 70 97 94 7a e5 2a ac b5 76 2f f5 4f 01 94 14 47 38 5e fa 4f 75 e6 3b e2 71 7a 54 bb cf 34 42 37 13 d1 aa a7 ad fb 26 42 cc cc e4 db 04 42 b8 72 d2 9e 47 44 d8 09 40 f4 74 5f af ea b5 3e 12 18 a6 8d 2a 73 32 af 4e 27 a3 7a 4c 96 89 66 d5 e7 35 cf f6 c4 ae d5 70 f0 bc 50 82 b9 ce 9d b3 f0 80 20 a6 7a 16 61 58 82 45 b6 a9 0b 1a 62 ee 0b 83 b8 13 78 4c b0 5c d7 9a 8f eb dd 29 0e 5d 01 e1 b6 cb b1 50 e8 37 29 3c a8 ac c2 7d 85 f3 8e 29 ad 31 1d 72 a7 c6 a1 Data Ascii: \b.vqmVP,p\83V#DBS"z!E.D%wm^&\\|340[1qB6Npzv/OG8^Ou;qzT4B7&BBrGD@t_>*s2N'zLf5pP zaXEbxL\)]P7)<})1r
2025-03-25 14:14:33 UTC	1369	IN	Data Raw: fa 9e f1 ac 0b f3 c2 fb 8e 0b 93 8d 4e d0 ea ff d1 73 9e 0b 56 f4 c7 bf 5d b8 cb b7 89 95 b9 a8 20 db a8 7a c1 34 6b 86 a4 22 2e be b2 72 28 0b db c5 49 ab 0c 4f e1 fc 24 7a 59 e9 ca 95 8c 38 f6 11 81 f0 d1 bf 69 68 89 e4 aa d2 fc 7e 56 80 ce c4 11 14 2a f7 4e cd 3f 0f f0 8c dd 56 44 5f c1 f4 a1 d4 a4 21 16 8c 73 c6 6f c1 4a ea a2 50 a2 3d c4 ff c8 3e 49 30 eb a8 ef f1 eb 99 c1 48 3d 98 ad 1f 8f e4 80 df 88 17 86 ed ee 50 d6 dc 81 e5 81 f4 0f 52 ac 31 3e e9 94 51 56 a8 3a 8c 0d 5e 82 b3 d1 02 84 db 4f e6 d8 1f ce c3 b5 bd d6 ee 02 23 0b d4 35 4f 48 e5 50 60 68 87 a1 14 ed 3c 42 11 29 41 ae a9 5c a1 9d 91 76 bb 21 0a 2e d0 c7 2a 55 8a 4f 2d 72 f4 82 92 06 f7 b5 e3 5b d9 1a 00 56 1b 23 eb 25 db 78 70 6c 5a 66 45 64 d3 1e 78 eb a6 5d ab e2 f4 90 79 f2 a5 42 Data Ascii: NsV] z4k".r(IO$zY8ih~VN?VD_!soJP=>I0H=PR1>QV:^O#5OHP`h<B)A\v!.UO-r[V#%xplZfEdx]yB
2025-03-25 14:14:33 UTC	1369	IN	Data Raw: 8b 31 58 8d 6c c4 ea 9a b7 e7 b1 9c 0f 06 30 71 22 75 ab 53 19 76 45 0b 25 1b 25 f5 da 35 61 cc 56 3d 65 c7 bf 2f bc 50 69 17 15 de 6b c9 12 77 5c 8d e7 0f 81 5e b8 0b 14 8f 7a d6 e3 83 f2 01 de 06 8b 30 5f 9e 0f e6 14 19 b2 f6 d7 dc 71 f5 98 37 0c 66 dc ab 03 ce ab 47 73 5e f9 2e 1b 9a 2b d2 8f 4c 41 2f ec f0 31 fe 8f 0d be 88 f6 ad d7 81 aa 41 b3 2c 12 1a 0f 67 18 62 8c 41 6b a2 d7 39 fa 29 ad 3a f2 85 3b de d0 c9 6c ef 38 ae 54 4f f8 58 39 3b db 27 22 1d 5f 4b ab 59 47 3a 63 07 cd 28 f5 fd 46 71 55 2d 27 52 a2 5b 99 26 34 b7 c2 61 ae 29 f5 15 ba 5c 07 98 c6 dd e2 d7 ec c2 e8 ff d9 b3 4a f1 67 bf d4 81 31 a4 a5 13 8a 66 6c 55 84 6f 38 96 fe 38 bc 96 1a 20 76 9c a4 93 2d 75 8e e8 4b 80 35 df ef 14 03 55 ea b3 36 bc b4 38 46 01 ee d1 68 43 12 27 b9 93 33 Data Ascii: 1Xl0q"uSvE%%5aV=e/Pikw\^z0_q7fGs^.+LA/1A,gbAk9):;l8TOX9;'"_KYG:c(FqU-'R[&4a)\Jg1flUo88 v-uK5U68FhC'3
2025-03-25 14:14:33 UTC	1369	IN	Data Raw: 4b ea 3c 34 af 55 74 e9 af b5 76 83 d4 4a d7 99 7c 98 9c 54 42 7d b5 7b b8 66 7b b1 e3 fc f9 27 82 16 4c 33 2b 59 df b3 40 f9 c0 45 95 94 29 bc 4b f8 a2 5c fe be 51 c8 f1 4e b9 ec 1d cc d4 c6 0a 57 13 56 2b 83 dd 08 fe bb f4 53 e3 6c cd bf a2 d1 e9 13 82 9b 3d 97 26 5b 3e bc a9 73 75 54 ec 60 63 26 71 57 57 29 d2 fe 49 6f 49 b1 67 66 57 33 c7 3e 6c a7 5c 15 b6 65 4e 0a 4d 93 05 4e db c0 68 17 45 81 df b1 c3 a9 3b a8 6c 31 c8 8a 8a 56 78 ba 72 52 fd 2c 65 a9 ca 39 6e fa 6f 28 5f 5c 17 9c 16 60 b6 82 49 ab da 04 47 e5 5d e1 38 62 a2 5b 9f 27 b6 59 65 de 29 54 cb 1c 48 83 2b 79 87 c3 1d a1 66 fc a8 1f 62 4f 64 9f 1c c7 c3 29 73 44 0c 00 be 3a 57 43 c1 00 e3 82 80 f4 15 59 8d 60 b9 1a ab b2 9d 58 86 b3 e8 15 67 f9 c7 ca fd eb cb 77 65 cd 58 55 11 78 53 a5 68 Data Ascii: K<4UtvJ\|TB}{f{'L3+Y@E)K\QNWV+Sl=&[>suT`c&qWW)IoIgfW3>l\eNMNhE;l1VxrR,e9no(_\`IG]8b['Ye)TH+yfbOd)sD:WCY`XgweXUxSh
2025-03-25 14:14:33 UTC	1369	IN	Data Raw: 98 ef 57 e7 77 ce 07 91 19 0b 86 77 d1 80 48 57 25 06 65 b9 ce 9a ab e0 21 4b d3 91 61 c7 35 38 5d f8 eb 8f 70 fa 5d ad 3d e7 5d fe f9 f4 c2 58 57 e9 be 6a 5e 3f 4c 90 49 d2 d5 ed 3b 08 ff a5 34 d9 af f3 bb 11 28 56 ed 25 ff f5 b7 a6 be 3f 1d ce e3 a8 ee 73 ec e2 79 f8 11 e3 e3 3d 67 86 ea 3f f8 94 4a 05 2e 97 f3 be eb 5a 86 80 f1 b8 ab df b6 c4 98 b3 17 29 ed 02 9a b3 e2 c1 6a df f6 69 c2 82 ed 51 51 af 90 7c 69 17 13 d9 f2 ce fa 0e c2 01 dc a1 be 0c 79 82 9f e8 d1 f2 21 eb bc ed 2f 8e 59 a2 0f b8 d1 0f 6d 8c 05 02 1c 0d 3f 2a 62 bd b7 1f 7a d1 19 e3 31 bb a0 1e 9f 70 38 ac be be 5e 5e d7 9b 2f 8f 9d 57 73 d1 c1 fc 98 e0 ef d8 85 35 6a 1e 79 8d 02 81 33 35 17 8e 2c f9 9e 14 96 a4 8f 5b ed 4e 96 8d ec b5 34 76 74 6d 41 10 c1 d0 83 ac fb 78 1f 91 ef 0c 69 Data Ascii: WwwHW%e!Ka58]p]=]XWj^?LI;4(V%?sy=g?J.Z)jiQQ\|iy!/Ym?*bz1p8^^/Ws5jy35,[N4vtmAxi
2025-03-25 14:14:33 UTC	1369	IN	Data Raw: c8 2b db d4 5f 3d 90 85 0f ad f2 a7 e3 af 27 92 21 ea 86 3e 2e cb 91 1f c8 ec 82 25 78 67 3f 5f 97 ba 5d 6a cc a4 8b 24 1e 48 2e 5a 83 4c 22 be 92 2d 53 c9 6b 63 fe 77 29 27 12 0b a3 8f 79 13 26 f4 32 d5 da b5 33 db 3b e9 36 45 a3 05 8a 8c 2d 6b a9 7f cf 7e 18 ed ac 67 5d 35 f0 73 d0 77 e8 26 7e 03 36 e4 72 e7 61 a7 c5 a2 68 d2 9f 65 fb f2 0a e7 38 f8 ee 59 37 2a 02 56 65 5c 4f 3c 9d 99 df 10 fa 62 de 98 ab 29 df 92 9e 73 9e d4 51 64 d4 24 da e7 a7 ac 17 15 a9 c6 e5 1d 16 97 11 d9 d4 57 cf d8 e5 ab 19 4e 63 1c bf 2e 7d 55 ce 37 2e e0 8b 1f 1b 98 4f 8c 85 df 48 08 fc 75 3b bb e0 cc 9e aa 74 b9 aa dc a5 cd bc 8b fc ab 33 36 d3 aa eb 5e 64 8d 14 8a 0b 89 2d 43 d3 9d 55 fa 71 42 5b 73 13 3d 74 16 26 77 4e 9c 5d 3d 3e 5f 21 3f 3f e7 cf 5b 1a b9 0e 9e 3b 37 fc Data Ascii: +_='!>.%xg?_]j$H.ZL"-Skcw)'y&23;6E-k~g]5sw&~6rahe8Y7*Ve\O<b)sQd$WNc.}U7.OHu;t36^d-CUqB[s=t&wN]=>_!??[;7
2025-03-25 14:14:33 UTC	1369	IN	Data Raw: ac 64 19 71 67 55 fe 94 c5 8e b1 db 1e ae ed df e1 e4 7e 85 a8 e6 67 cf e3 82 bc e8 7d 77 33 20 33 b1 82 61 7d df 85 bb 3f ef 7a 55 08 25 30 6c 2d e1 c0 71 7e 56 a6 c4 2b 99 6b 3f 5b 80 52 52 50 0a bf 8c 73 6d 3c 8a e6 78 96 19 82 90 db ba a2 73 a5 ce 7b 05 22 05 df c7 b9 14 2a b7 6a 8b b5 64 c6 6b c9 2a 18 27 fc 6a d8 5f ea 57 ea a0 b1 a0 26 80 d3 79 15 4e a1 47 b4 3d 8f 4f 06 92 86 e2 3a 77 17 8d e3 10 87 7b 84 3c f6 0c 3b 8d 4a 79 1f 4d cd 1b 06 35 8c ae 21 b8 1f b1 5a 25 71 bc e5 28 06 fa 8a ba e1 24 03 5d 80 76 5c 71 19 ca ca 53 8c 60 9e f1 a5 1e cf 51 a3 c3 11 c6 c2 91 2b c8 35 1c 73 d7 55 18 19 8f 87 bf 38 e2 38 84 3b d3 7c b5 c9 e7 ea 11 71 b4 34 63 2b c0 61 06 05 c6 8d 0c cf 7f 1e 47 08 f8 a0 bb a9 64 54 5f d0 19 3d 22 e8 fb 1b 9f e3 ef 81 b1 c6 Data Ascii: dqgU~g}w3 3a}?zU%0l-q~V+k?[RRPsm<xs{"jdk'j_W&yNG=O:w{<;JyM5!Z%q($]v\qS`Q+5sU88;\|q4c+aGdT_="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49180	148.135.1.141	443	936	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:14:33 UTC	368	OUT	GET /favicon.ico HTTP/1.1 Host: lawful-lamontagne-7e83y.zipwp.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-03-25 14:14:34 UTC	279	IN	HTTP/1.1 200 OK Server: nginx-rc Date: Tue, 25 Mar 2025 14:14:33 GMT Content-Type: text/html Content-Length: 5606 Last-Modified: Thu, 28 Nov 2024 12:32:31 GMT Connection: close Vary: Accept-Encoding ETag: "674862df-15e6" Content-Type: text/html Accept-Ranges: bytes
2025-03-25 14:14:34 UTC	5606	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Verification</title> <style type="text/css"> body { margin: 0; }

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 3056, Parent PID: 1884

Function Logs

General

Target ID:	0
Start time:	10:14:19
Start date:	25/03/2025
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x13fc50000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

Process Created

Process Terminated

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 936, Parent PID: 3056

Function Logs

General

Target ID:	1
Start time:	10:14:20
Start date:	25/03/2025
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1432 --field-trial-handle=1236,i,15996112504366120973,10164845657667848202,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x13fc50000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 1628, Parent PID: 1884

Function Logs

General

Target ID:	4
Start time:	10:14:28
Start date:	25/03/2025
Path:	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" "https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php"
Imagebase:	0x13fc50000
File size:	3'151'128 bytes
MD5 hash:	FFA2B8E17F645BCC20F0E0201FEF83ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 3056, Parent PID: 1884

General

File Activities

File Opened

File Created

Windows Analysis Report
https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php