Edit tour

Windows Analysis Report
https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php

Overview

General Information

Sample URL:	https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php
Analysis ID:	1648130
Infos:

Detection

Score:	56
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Creates files inside the system directory

Deletes files inside the Windows folder

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3772 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5052 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2064,i,3254435716139963034,11654077455934367133,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php

Avira URL Cloud: detection malicious, Label: malware

Antivirus detection for URL or domain

Source: https://lawful-lamontagne-7e83y.zipwp.top/favicon.ico

Avira URL Cloud: Label: malware

Source: https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 172.217.165.132:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.180:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.180:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.180:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.33.40.150
Source: unknown	TCP traffic detected without corresponding DNS query: 23.13.145.132
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /zipwp-login-67e2afa011731.php HTTP/1.1Host: lawful-lamontagne-7e83y.zipwp.topConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/lock-icon.svg HTTP/1.1Host: zipwp.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://lawful-lamontagne-7e83y.zipwp.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/lock-icon.svg HTTP/1.1Host: zipwp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/site-image.png HTTP/1.1Host: zipwp.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://lawful-lamontagne-7e83y.zipwp.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: lawful-lamontagne-7e83y.zipwp.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.phpAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/site-image.png HTTP/1.1Host: zipwp.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: lawful-lamontagne-7e83y.zipwp.topConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: lawful-lamontagne-7e83y.zipwp.top
Source: global traffic	DNS traffic detected: DNS query: zipwp.com

Source: chromecache_56.2.dr, chromecache_54.2.dr, chromecache_52.2.dr	String found in binary or memory: https://zipwp.com/
Source: chromecache_56.2.dr, chromecache_54.2.dr, chromecache_52.2.dr	String found in binary or memory: https://zipwp.com/images/lock-icon.svg
Source: chromecache_56.2.dr, chromecache_54.2.dr, chromecache_52.2.dr	String found in binary or memory: https://zipwp.com/images/site-image.png

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.217.165.132:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.180:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.180:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.1.180:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.135.1.141:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir3772_702442051

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir3772_702442051

Jump to behavior

Source: classification engine

Classification label: mal56.win@21/13@11/4

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2064,i,3254435716139963034,11654077455934367133,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2064,i,3254435716139963034,11654077455934367133,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php	100%	Avira URL Cloud	malware

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://lawful-lamontagne-7e83y.zipwp.top/favicon.ico	100%	Avira URL Cloud	malware
https://zipwp.com/	0%	Avira URL Cloud	safe
https://zipwp.com/images/lock-icon.svg	0%	Avira URL Cloud	safe
https://zipwp.com/images/site-image.png	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
lawful-lamontagne-7e83y.zipwp.top	148.135.1.141	true	false	high
www.google.com	172.217.165.132	true	false	high
zipwp.com	104.26.1.180	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://zipwp.com/images/lock-icon.svg	false	Avira URL Cloud: safe	unknown
https://zipwp.com/images/site-image.png	false	Avira URL Cloud: safe	unknown
https://lawful-lamontagne-7e83y.zipwp.top/favicon.ico	false	Avira URL Cloud: malware	unknown
https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://zipwp.com/	chromecache_56.2.dr, chromecache_54.2.dr, chromecache_52.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.1.180	zipwp.com	United States	13335	CLOUDFLARENETUS	false
148.135.1.141	lawful-lamontagne-7e83y.zipwp.top	Sweden	158	ERI-ASUS	false
172.217.165.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1648130
Start date and time:	2025-03-25 15:16:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@21/13@11/4

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.251.41.14, 172.253.62.84, 142.250.81.227, 142.251.40.238, 142.250.72.110, 142.251.40.110, 142.250.80.110, 142.251.40.170, 142.250.65.170, 142.250.80.74, 142.250.72.106, 172.217.165.138, 142.250.65.202, 142.251.40.234, 142.250.64.106, 142.250.80.10, 142.251.40.138, 142.250.80.42, 142.250.176.202, 142.250.64.74, 142.250.80.106, 142.251.40.202, 142.251.41.10, 23.203.176.221, 142.251.32.110, 142.250.65.206, 142.250.72.99, 142.251.40.99, 142.250.65.174, 184.31.69.3, 204.79.197.222, 20.12.23.50
Excluded domains from analysis (whitelisted): fp.msedge.net, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 49

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HuKxIn:Od
MD5:	B945405A7A318AFB3B93AFFADC4FD978
SHA1:	798253494061EB1B723D1CF033DEE6DFCD65C839
SHA-256:	71BBB2B9C261452AC047D5212D12FD152D82F642B7960D2E0BF239FA6C970AD1
SHA-512:	85826B7066C7C362245FFCEF4F1C1D70501D82DCA077EA62F830988353AD6140337C733AAF916894EE23D230A395E1989B52DE7ED888CEB09F59CF12544495C1
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIZCVr5ZFROkIidEgUN0P0zByEfYPtC9HTfxw==?alt=proto
Preview:	CgkKBw3Q/TMHGgA=

Chrome Cache Entry: 50

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1200 x 1080, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	938994
Entropy (8bit):	7.990755330865723
Encrypted:	true
SSDEEP:	24576:wbae0EpqD+27Feoj8RA3z3lfYh+1MeKlGw5m1:KaTf+2JcAjVfc+1MeKln5S
MD5:	364120324661D7263C4B6DEEA15F9ADE
SHA1:	2CDC7A50695B8738C62BBD560535885CF90334CB
SHA-256:	07E79354AD059F0727D39A389C6EA9E870681A3D915DC5DCFDE9B2406F218068
SHA-512:	F3A02377260FD06030BCA53D01918778A18B091124D5699AB67571851BE9E57DC7AC84B697882A9364D7CCE047981761305EC92FED9D880021B65BE8D54A8AF0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......8.......%z....pHYs.................sRGB.........gAMA......a...S.IDATx...k.#..-..&E.u.._=....{Ue..-.....&.8...L.If\|. ..IP.....k.N.3...x&K..o.].{.cK.xv....3..]......Y...+.c..%.R>\|G[....a..:?=.E9-.,y.....s........8.l.g...1...o..J..^.3............^0..ZcxM....x,c'..w..J...\|...8b........y.'.}...FF;oz.m......3..x.^.......8...0...M.G..}.:...?.~.....K....\|.i0.r.\|.............n.......8.0.l..<....q..Bsc::V....^./.^M...a....c,......z......<,..v..e..}.:o..Z...\..N.Q7jN.x...;:\a.4....\|.+.......{..\|?.?&^....4...5...u...1..~..1.0V....p.)..x.,u.\..m.O.n._T...<r......JMkC...............K.........C........:.....b..z..96c~KI...t.]..\|..M:Q....4....=iX.G.w..y/.r....}k.F...?....-...m.e.....0&....u...k....R^o.=........s..s...}.z.%...w.17.;......m.G{....z.cb......z.G.y.o.l.?..x\|.\|....?..Y..w.x..\|...F..y:.>'..z...g..J<~.a...~....].h.U..w..c,c.....1....e......].2.L..\|.......a............uM..8J...V:.-:.......q...u../._.~..v..d/.0?..m^....sL...4..

Chrome Cache Entry: 51

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	667
Entropy (8bit):	5.259437698800801
Encrypted:	false
SSDEEP:	12:tr/BWGuCtNIe/nL6t7MGZLWRRlV2LGXnCqjhll4XMRYBc4HxNNcGMXGrDPGGA:tzBXuENLLY7dLWRbsLACqjhllafBNHxk
MD5:	A132F48F1BA50AB81AC2011874827C7C
SHA1:	700CE9732FC5F4AB0724A69181836C095FFEE4C8
SHA-256:	BC24C19D990961C31F220CDB0DCB5D364E46F0F1C2682102591FCD9D478B32DC
SHA-512:	E4803F11169D8790B4DD3DF0834736BAE4B2265214562B9A5560CDEF6DD5D6F0AA0AA673EA64D505808F9B27A9875BF7FCB3EB5A4E2A9C145FCFE47705CC1336
Malicious:	false
Reputation:	low
URL:	https://zipwp.com/images/lock-icon.svg
Preview:	<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M22 14V9C22 5.68629 19.3137 3 16 3C12.6863 3 10 5.68629 10 9V14M9 29H23C24.6569 29 26 27.6569 26 26V17C26 15.3431 24.6569 14 23 14H9C7.34315 14 6 15.3431 6 17V26C6 27.6569 7.34315 29 9 29Z" stroke="url(#paint0_linear_19217_22462)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>.<defs>.<linearGradient id="paint0_linear_19217_22462" x1="6" y1="16" x2="26" y2="16" gradientUnits="userSpaceOnUse">.<stop stop-color="#B809A7"/>.<stop offset="0.46875" stop-color="#E90B76"/>.<stop offset="1" stop-color="#FC8536"/>.</linearGradient>.</defs>.</svg>.

Chrome Cache Entry: 52

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	5606
Entropy (8bit):	4.1592778340450405
Encrypted:	false
SSDEEP:	96:sn5wFUtF2cAuFiWrFc/YpRuGudwIPyOSX3AHb:sn5wGt8cAuFbrFmMRuGuxPylX3c
MD5:	9B150330301E502BD58FC5B795902F66
SHA1:	59559C92C5EA91A99B3B288B79C114B8D411B50A
SHA-256:	89F57C0D9E14EB55394A7C5E24FCE9519F56C325267766A1FC3B3847938FE103
SHA-512:	B1E4131FC30FC81CDB18D4DC0A05ADDD6383065A2F5AD99F1B14B9A48364466FE2BC2547DDD52B2649BB9CCC71939FE57DBFF07000DD783A627B1C9F5E679BDE
Malicious:	false
Reputation:	low
URL:	https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Verification</title>. <style type="text/css">. body {. margin: 0;. }. .zipwp-container {. width: 100%;. }.. .zipwp-row {. display: flex;. }.. .zipwp-image {. width: 100%;. height: 100vh;. background-image: url( "https://zipwp.com/images/site-image.png" );. background-size: cover;. background-position: center center;. }.. .zipwp-password-icon {. width: 32px;. height: 32px;. }.. .zipwp-content {. width: 48%;. background-color: #fff;. padding: 2rem;. display: flex;. flex-direction: column;. align-items: center;. font-family: Figtree, sans-serif;. }.. .zipwp-login

Chrome Cache Entry: 53

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1200 x 1080, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	938994
Entropy (8bit):	7.990755330865723
Encrypted:	true
SSDEEP:	24576:wbae0EpqD+27Feoj8RA3z3lfYh+1MeKlGw5m1:KaTf+2JcAjVfc+1MeKln5S
MD5:	364120324661D7263C4B6DEEA15F9ADE
SHA1:	2CDC7A50695B8738C62BBD560535885CF90334CB
SHA-256:	07E79354AD059F0727D39A389C6EA9E870681A3D915DC5DCFDE9B2406F218068
SHA-512:	F3A02377260FD06030BCA53D01918778A18B091124D5699AB67571851BE9E57DC7AC84B697882A9364D7CCE047981761305EC92FED9D880021B65BE8D54A8AF0
Malicious:	false
Reputation:	low
URL:	https://zipwp.com/images/site-image.png
Preview:	.PNG........IHDR.......8.......%z....pHYs.................sRGB.........gAMA......a...S.IDATx...k.#..-..&E.u.._=....{Ue..-.....&.8...L.If\|. ..IP.....k.N.3...x&K..o.].{.cK.xv....3..]......Y...+.c..%.R>\|G[....a..:?=.E9-.,y.....s........8.l.g...1...o..J..^.3............^0..ZcxM....x,c'..w..J...\|...8b........y.'.}...FF;oz.m......3..x.^.......8...0...M.G..}.:...?.~.....K....\|.i0.r.\|.............n.......8.0.l..<....q..Bsc::V....^./.^M...a....c,......z......<,..v..e..}.:o..Z...\..N.Q7jN.x...;:\a.4....\|.+.......{..\|?.?&^....4...5...u...1..~..1.0V....p.)..x.,u.\..m.O.n._T...<r......JMkC...............K.........C........:.....b..z..96c~KI...t.]..\|..M:Q....4....=iX.G.w..y/.r....}k.F...?....-...m.e.....0&....u...k....R^o.=........s..s...}.z.%...w.17.;......m.G{....z.cb......z.G.y.o.l.?..x\|.\|....?..Y..w.x..\|...F..y:.>'..z...g..J<~.a...~....].h.U..w..c,c.....1....e......].2.L..\|.......a............uM..8J...V:.-:.......q...u../._.~..v..d/.0?..m^....sL...4..

Chrome Cache Entry: 54

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5606
Entropy (8bit):	4.1592778340450405
Encrypted:	false
SSDEEP:	96:sn5wFUtF2cAuFiWrFc/YpRuGudwIPyOSX3AHb:sn5wGt8cAuFbrFmMRuGuxPylX3c
MD5:	9B150330301E502BD58FC5B795902F66
SHA1:	59559C92C5EA91A99B3B288B79C114B8D411B50A
SHA-256:	89F57C0D9E14EB55394A7C5E24FCE9519F56C325267766A1FC3B3847938FE103
SHA-512:	B1E4131FC30FC81CDB18D4DC0A05ADDD6383065A2F5AD99F1B14B9A48364466FE2BC2547DDD52B2649BB9CCC71939FE57DBFF07000DD783A627B1C9F5E679BDE
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Verification</title>. <style type="text/css">. body {. margin: 0;. }. .zipwp-container {. width: 100%;. }.. .zipwp-row {. display: flex;. }.. .zipwp-image {. width: 100%;. height: 100vh;. background-image: url( "https://zipwp.com/images/site-image.png" );. background-size: cover;. background-position: center center;. }.. .zipwp-password-icon {. width: 32px;. height: 32px;. }.. .zipwp-content {. width: 48%;. background-color: #fff;. padding: 2rem;. display: flex;. flex-direction: column;. align-items: center;. font-family: Figtree, sans-serif;. }.. .zipwp-login

Chrome Cache Entry: 55

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	667
Entropy (8bit):	5.259437698800801
Encrypted:	false
SSDEEP:	12:tr/BWGuCtNIe/nL6t7MGZLWRRlV2LGXnCqjhll4XMRYBc4HxNNcGMXGrDPGGA:tzBXuENLLY7dLWRbsLACqjhllafBNHxk
MD5:	A132F48F1BA50AB81AC2011874827C7C
SHA1:	700CE9732FC5F4AB0724A69181836C095FFEE4C8
SHA-256:	BC24C19D990961C31F220CDB0DCB5D364E46F0F1C2682102591FCD9D478B32DC
SHA-512:	E4803F11169D8790B4DD3DF0834736BAE4B2265214562B9A5560CDEF6DD5D6F0AA0AA673EA64D505808F9B27A9875BF7FCB3EB5A4E2A9C145FCFE47705CC1336
Malicious:	false
Reputation:	low
Preview:	<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M22 14V9C22 5.68629 19.3137 3 16 3C12.6863 3 10 5.68629 10 9V14M9 29H23C24.6569 29 26 27.6569 26 26V17C26 15.3431 24.6569 14 23 14H9C7.34315 14 6 15.3431 6 17V26C6 27.6569 7.34315 29 9 29Z" stroke="url(#paint0_linear_19217_22462)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>.<defs>.<linearGradient id="paint0_linear_19217_22462" x1="6" y1="16" x2="26" y2="16" gradientUnits="userSpaceOnUse">.<stop stop-color="#B809A7"/>.<stop offset="0.46875" stop-color="#E90B76"/>.<stop offset="1" stop-color="#FC8536"/>.</linearGradient>.</defs>.</svg>.

Chrome Cache Entry: 56

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	5606
Entropy (8bit):	4.1592778340450405
Encrypted:	false
SSDEEP:	96:sn5wFUtF2cAuFiWrFc/YpRuGudwIPyOSX3AHb:sn5wGt8cAuFbrFmMRuGuxPylX3c
MD5:	9B150330301E502BD58FC5B795902F66
SHA1:	59559C92C5EA91A99B3B288B79C114B8D411B50A
SHA-256:	89F57C0D9E14EB55394A7C5E24FCE9519F56C325267766A1FC3B3847938FE103
SHA-512:	B1E4131FC30FC81CDB18D4DC0A05ADDD6383065A2F5AD99F1B14B9A48364466FE2BC2547DDD52B2649BB9CCC71939FE57DBFF07000DD783A627B1C9F5E679BDE
Malicious:	false
Reputation:	low
URL:	https://lawful-lamontagne-7e83y.zipwp.top/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <title>Verification</title>. <style type="text/css">. body {. margin: 0;. }. .zipwp-container {. width: 100%;. }.. .zipwp-row {. display: flex;. }.. .zipwp-image {. width: 100%;. height: 100vh;. background-image: url( "https://zipwp.com/images/site-image.png" );. background-size: cover;. background-position: center center;. }.. .zipwp-password-icon {. width: 32px;. height: 32px;. }.. .zipwp-content {. width: 48%;. background-color: #fff;. padding: 2rem;. display: flex;. flex-direction: column;. align-items: center;. font-family: Figtree, sans-serif;. }.. .zipwp-login

Static File Info

⊘No static file info

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 448
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 15:17:51.070595026 CET	49671	443	192.168.2.4	204.79.197.203
Mar 25, 2025 15:17:51.384608030 CET	49671	443	192.168.2.4	204.79.197.203
Mar 25, 2025 15:17:51.993928909 CET	49671	443	192.168.2.4	204.79.197.203
Mar 25, 2025 15:17:53.250972033 CET	49671	443	192.168.2.4	204.79.197.203
Mar 25, 2025 15:17:55.681493044 CET	49671	443	192.168.2.4	204.79.197.203
Mar 25, 2025 15:17:57.766727924 CET	49731	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:17:57.766819000 CET	443	49731	172.217.165.132	192.168.2.4
Mar 25, 2025 15:17:57.766944885 CET	49731	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:17:57.767096996 CET	49731	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:17:57.767119884 CET	443	49731	172.217.165.132	192.168.2.4
Mar 25, 2025 15:17:58.032351971 CET	443	49731	172.217.165.132	192.168.2.4
Mar 25, 2025 15:17:58.032447100 CET	49731	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:17:58.033680916 CET	49731	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:17:58.033708096 CET	443	49731	172.217.165.132	192.168.2.4
Mar 25, 2025 15:17:58.034018993 CET	443	49731	172.217.165.132	192.168.2.4
Mar 25, 2025 15:17:58.088957071 CET	49731	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:17:59.762286901 CET	49678	443	192.168.2.4	20.189.173.27
Mar 25, 2025 15:18:00.074357986 CET	49678	443	192.168.2.4	20.189.173.27
Mar 25, 2025 15:18:00.293840885 CET	49734	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.293874025 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.293971062 CET	49734	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.294537067 CET	49735	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.294559002 CET	443	49735	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.294641972 CET	49735	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.294936895 CET	49735	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.294950962 CET	443	49735	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.295308113 CET	49734	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.295322895 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.481482029 CET	49671	443	192.168.2.4	204.79.197.203
Mar 25, 2025 15:18:00.683430910 CET	49678	443	192.168.2.4	20.189.173.27
Mar 25, 2025 15:18:00.860004902 CET	443	49735	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.860076904 CET	49735	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.864141941 CET	49735	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.864156961 CET	443	49735	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.864367962 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.864419937 CET	443	49735	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.864447117 CET	49734	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.865087986 CET	49735	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.865377903 CET	49734	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:00.865403891 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.865808010 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.912276983 CET	443	49735	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:00.916614056 CET	49734	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:01.200567007 CET	443	49735	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:01.200587988 CET	443	49735	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:01.200660944 CET	443	49735	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:01.200808048 CET	49735	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:01.200808048 CET	49735	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:01.356154919 CET	49735	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:01.356184959 CET	443	49735	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:01.520648003 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:01.520684958 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:01.520770073 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:01.521028996 CET	49738	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:01.521039963 CET	443	49738	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:01.521100998 CET	49738	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:01.521493912 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:01.521508932 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:01.521670103 CET	49738	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:01.521682978 CET	443	49738	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:01.756462097 CET	443	49738	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:01.756567001 CET	49738	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:01.757761002 CET	49738	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:01.757775068 CET	443	49738	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:01.758117914 CET	443	49738	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:01.758404016 CET	49738	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:01.800297022 CET	443	49738	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:01.889846087 CET	49678	443	192.168.2.4	20.189.173.27
Mar 25, 2025 15:18:02.068085909 CET	443	49738	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.068228006 CET	443	49738	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.068286896 CET	49738	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:02.069500923 CET	49738	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:02.069526911 CET	443	49738	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.213496923 CET	49741	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:02.213541031 CET	443	49741	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.213686943 CET	49741	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:02.213855028 CET	49741	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:02.213869095 CET	443	49741	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.496798992 CET	443	49741	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.496900082 CET	49741	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:02.497390985 CET	49741	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:02.497405052 CET	443	49741	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.497745991 CET	443	49741	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.497997046 CET	49741	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:02.540294886 CET	443	49741	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.833359003 CET	443	49741	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.833509922 CET	443	49741	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.833709955 CET	49741	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:02.834835052 CET	49741	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:02.834855080 CET	443	49741	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:02.954896927 CET	49681	80	192.168.2.4	2.17.190.73
Mar 25, 2025 15:18:03.267426968 CET	49681	80	192.168.2.4	2.17.190.73
Mar 25, 2025 15:18:03.634324074 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:03.634447098 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:03.831440926 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:03.831494093 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:03.832465887 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:03.871829033 CET	49681	80	192.168.2.4	2.17.190.73
Mar 25, 2025 15:18:03.881086111 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:03.905591011 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:03.948283911 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.069320917 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.069470882 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.069541931 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.069578886 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.069691896 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.069746017 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.069761038 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.069875956 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.069933891 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.069947004 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.070092916 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.070168972 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.070180893 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.070307970 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.070389986 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.070403099 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.072423935 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.072499037 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.072514057 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.072618961 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.072949886 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.072949886 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.072979927 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.073173046 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.073240042 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.073254108 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.073311090 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.126858950 CET	49709	443	192.168.2.4	131.253.33.254
Mar 25, 2025 15:18:04.127187967 CET	49709	443	192.168.2.4	131.253.33.254
Mar 25, 2025 15:18:04.127302885 CET	49709	443	192.168.2.4	131.253.33.254
Mar 25, 2025 15:18:04.209748030 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.209819078 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.209855080 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.209888935 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.209904909 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.209916115 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.209933996 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.209943056 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.209975958 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.209975958 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.209990025 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210027933 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210037947 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.210052013 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210078955 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210098982 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.210105896 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210117102 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210156918 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.210166931 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210213900 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210252047 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.210259914 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210324049 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210371971 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.210380077 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210422993 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.210429907 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210499048 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210570097 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210618019 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.210625887 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.210666895 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.210673094 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.234276056 CET	443	49709	131.253.33.254	192.168.2.4
Mar 25, 2025 15:18:04.235593081 CET	443	49709	131.253.33.254	192.168.2.4
Mar 25, 2025 15:18:04.235615015 CET	443	49709	131.253.33.254	192.168.2.4
Mar 25, 2025 15:18:04.235707998 CET	49709	443	192.168.2.4	131.253.33.254
Mar 25, 2025 15:18:04.237304926 CET	443	49709	131.253.33.254	192.168.2.4
Mar 25, 2025 15:18:04.237340927 CET	443	49709	131.253.33.254	192.168.2.4
Mar 25, 2025 15:18:04.237369061 CET	49709	443	192.168.2.4	131.253.33.254
Mar 25, 2025 15:18:04.237413883 CET	49709	443	192.168.2.4	131.253.33.254
Mar 25, 2025 15:18:04.242434978 CET	49709	443	192.168.2.4	131.253.33.254
Mar 25, 2025 15:18:04.252861023 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.252893925 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.259958982 CET	49709	443	192.168.2.4	131.253.33.254
Mar 25, 2025 15:18:04.301254988 CET	49678	443	192.168.2.4	20.189.173.27
Mar 25, 2025 15:18:04.301379919 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.343308926 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.343327999 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.343379974 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.343379974 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.343425989 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.343436003 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.343451023 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.343476057 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.343506098 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.343511105 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.343559980 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.343571901 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.348397017 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.348433018 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.348469019 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.348474026 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.348483086 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.348520041 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.348545074 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.354239941 CET	443	49709	131.253.33.254	192.168.2.4
Mar 25, 2025 15:18:04.372891903 CET	443	49709	131.253.33.254	192.168.2.4
Mar 25, 2025 15:18:04.374157906 CET	443	49709	131.253.33.254	192.168.2.4
Mar 25, 2025 15:18:04.374198914 CET	443	49709	131.253.33.254	192.168.2.4
Mar 25, 2025 15:18:04.374217033 CET	49709	443	192.168.2.4	131.253.33.254
Mar 25, 2025 15:18:04.374236107 CET	49709	443	192.168.2.4	131.253.33.254
Mar 25, 2025 15:18:04.475658894 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.475750923 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.475778103 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.475841045 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630110979 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630158901 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630172968 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630187035 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630204916 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630209923 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630218029 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630239964 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630244970 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630260944 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630278111 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630296946 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630297899 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630331993 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630333900 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630341053 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630362034 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630371094 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630393982 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630400896 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630415916 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630417109 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630444050 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630465984 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630465984 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630477905 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630500078 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630501032 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630526066 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630527973 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630537033 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630551100 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630558968 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630593061 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630599976 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630608082 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630621910 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630621910 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630645990 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630661011 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630666971 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630677938 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630713940 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630737066 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630738974 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630749941 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630767107 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630775928 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630786896 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630805016 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630810976 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630817890 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630832911 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630834103 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630862951 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630867958 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630877972 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630894899 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630908012 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630920887 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630928040 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.630955935 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.630956888 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.631009102 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.631019115 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.631061077 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.631221056 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.769124031 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.769182920 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.769227028 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.769259930 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.769282103 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.769304037 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770283937 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770317078 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770325899 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770343065 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770350933 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770369053 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770410061 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770450115 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770452023 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770462990 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770483017 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770500898 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770514965 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770518064 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770529985 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770540953 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770550013 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770562887 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770581007 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770591021 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770606041 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770608902 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770622969 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770637989 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770657063 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770668983 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770685911 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770694017 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770714998 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770714998 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770730019 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770741940 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770750046 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770765066 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770767927 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770778894 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770782948 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770807981 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770814896 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770829916 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770843029 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770853996 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770884991 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770895004 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770909071 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770910025 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770927906 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770960093 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770967960 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770982981 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.770982981 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.770998001 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.771033049 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.771039963 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.771055937 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.771064997 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.771094084 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.771100998 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.771114111 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.771138906 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.771955967 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.772015095 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.894706011 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.894730091 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.894834995 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.894864082 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.894915104 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.895149946 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.895173073 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.895207882 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.895215988 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.895234108 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.895245075 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.895256042 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.895268917 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.895276070 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.895292997 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.895306110 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.895328999 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.895334959 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.895344019 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.895375967 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.895391941 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.895400047 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.895430088 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.895452976 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896229029 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896245956 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896291971 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896295071 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896312952 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896328926 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896330118 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896361113 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896368027 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896385908 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896385908 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896401882 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896429062 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896435976 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896451950 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896467924 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896471024 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896506071 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896513939 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896527052 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896539927 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896543026 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896567106 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896574020 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896590948 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896608114 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896610975 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896646976 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896655083 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.896672964 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.896706104 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983319044 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983344078 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983391047 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983464956 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983489990 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983489990 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983489990 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983501911 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983520031 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983531952 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983551025 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983573914 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983575106 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983586073 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983608961 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983620882 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983637094 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983637094 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983650923 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983669043 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983683109 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983694077 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983721972 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983730078 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983741999 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983755112 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983757973 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983772039 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983802080 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983810902 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983824968 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983833075 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983836889 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983870983 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983884096 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983891964 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983901024 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983920097 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983931065 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983937025 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983968019 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.983973026 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.983989000 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984003067 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984016895 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984045029 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984067917 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984082937 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984116077 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984117985 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984164000 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984168053 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984180927 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984210014 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984210968 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984230042 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984241009 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984277010 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984289885 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984308958 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984308958 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984328985 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984350920 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984361887 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984361887 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984369993 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984406948 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984420061 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984445095 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984450102 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984466076 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984468937 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984481096 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984515905 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984520912 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984536886 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984544039 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984566927 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984570980 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984584093 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984608889 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984625101 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984658003 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984669924 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:04.984713078 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:04.984831095 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.080864906 CET	49681	80	192.168.2.4	2.17.190.73
Mar 25, 2025 15:18:05.096064091 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096141100 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096188068 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096220970 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096241951 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096266031 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096317053 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096363068 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096388102 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096396923 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096415997 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096441984 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096487045 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096530914 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096549988 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096558094 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096585989 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096597910 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096625090 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096676111 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096693993 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096702099 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096726894 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096739054 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096770048 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096829891 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.096837044 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096935987 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.096980095 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.097129107 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.098067999 CET	49737	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.098078012 CET	443	49737	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.107980967 CET	49734	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:05.130172014 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.130228043 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.130302906 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.130409002 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.130419970 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.152272940 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:05.308365107 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:05.308418036 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:05.308476925 CET	49734	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:05.308505058 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:05.308562040 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:05.308598995 CET	49734	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:05.314342022 CET	49734	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:05.314359903 CET	443	49734	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:05.425149918 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.430866957 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.430896044 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.430948973 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.430954933 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.561844110 CET	49746	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:05.561888933 CET	443	49746	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:05.561969995 CET	49746	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:05.562105894 CET	49746	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:05.562118053 CET	443	49746	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:05.763955116 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.763982058 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764003992 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764023066 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764025927 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.764039040 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764056921 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764075041 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.764076948 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764085054 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764087915 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.764118910 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.764122963 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764143944 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764183998 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.764193058 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764940977 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.764971972 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.764975071 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.765000105 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.765037060 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.765043020 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.766017914 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.766035080 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.766063929 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.766068935 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.766314983 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.766416073 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.766447067 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.766467094 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.766479015 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.766483068 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.766549110 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.766997099 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.767110109 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.767148972 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.767153025 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.767702103 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.767736912 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.767749071 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.767751932 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.767848015 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.767854929 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.767997980 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.768004894 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.768047094 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.768053055 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.768136024 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.768771887 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.768927097 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.768960953 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.768979073 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.768984079 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.769015074 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.769056082 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.769141912 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.769170046 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.769193888 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.769208908 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.769215107 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.769227028 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.770083904 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.770155907 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.770190001 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.770230055 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.903621912 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.903696060 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.903762102 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.903762102 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.903800964 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.903847933 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:05.904540062 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:05.904587030 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.042171955 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.042264938 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.042315960 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.042365074 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.042463064 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.042506933 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.042515993 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.042526007 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.042545080 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.042546034 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.042562008 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.042567015 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.042582989 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.042584896 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.042629957 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.042635918 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.042773962 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.043705940 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.043754101 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.043759108 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.043764114 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.043787956 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.043807983 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.045479059 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.045531034 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.047437906 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.047485113 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.047488928 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.047502995 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.047529936 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.047544003 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.047583103 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.047590971 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.047631979 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.119334936 CET	443	49746	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:06.119513988 CET	49746	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:06.119812965 CET	49746	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:06.119823933 CET	443	49746	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:06.120045900 CET	443	49746	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:06.120460033 CET	49746	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:06.164278984 CET	443	49746	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:06.173583984 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173659086 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173675060 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173675060 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.173687935 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173718929 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.173728943 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173760891 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.173767090 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173777103 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173809052 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.173815966 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173856974 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173878908 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.173882961 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173894882 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.173897028 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173929930 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173943996 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.173948050 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.173965931 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.175123930 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.175173998 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.175179005 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.175214052 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.175245047 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.175287008 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.175421000 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.175465107 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.176579952 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.176630020 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.177308083 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.177356958 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.306803942 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.306864977 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.306905985 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.306911945 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.306946993 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.306982040 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.307667017 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.307707071 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.307737112 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.307743073 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.307775021 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.307781935 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.307789087 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.307817936 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.307820082 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.307842970 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.307847977 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.307869911 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.307876110 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.307907104 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.307917118 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.307924032 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.307950020 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.311239958 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311276913 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311310053 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311326981 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.311335087 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311377048 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.311383963 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311403990 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311424017 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.311429024 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311460018 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311476946 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311480045 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.311489105 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311515093 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.311547995 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.311551094 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311562061 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311577082 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311604977 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.311611891 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.311635017 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.312544107 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.312567949 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.312598944 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.312606096 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.312638998 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.343705893 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.344007015 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.426460028 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.426486969 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.426640034 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.426640034 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.426671982 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.426727057 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.428864956 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.428883076 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.428936005 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.428944111 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.428980112 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.431684017 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.431701899 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.431756020 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.431762934 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.434669971 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.434695959 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.435636997 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.435643911 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.436753988 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.436772108 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.436825037 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.436832905 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.436868906 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.439563990 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.439582109 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.439625978 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.439632893 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.439671040 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.442773104 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.442790985 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.442842960 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.442848921 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.442886114 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.445130110 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.445173979 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.445229053 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.445235968 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.445276022 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.447437048 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.447454929 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.447494030 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.447503090 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.447526932 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.447545052 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.475766897 CET	443	49746	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:06.475795984 CET	443	49746	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:06.475860119 CET	443	49746	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:06.475903034 CET	49746	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:06.475933075 CET	49746	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:06.496622086 CET	49746	443	192.168.2.4	148.135.1.141
Mar 25, 2025 15:18:06.496651888 CET	443	49746	148.135.1.141	192.168.2.4
Mar 25, 2025 15:18:06.738322973 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738372087 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738413095 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738444090 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738459110 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738482952 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738486052 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738518000 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738524914 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738548040 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738552094 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738567114 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738595963 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738601923 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738626957 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738639116 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738651991 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738677025 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738682032 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738708973 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738723993 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738730907 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738737106 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738753080 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738781929 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738787889 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738833904 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738856077 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738879919 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738884926 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738904953 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738914967 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738933086 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738936901 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738944054 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.738962889 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.738991022 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739011049 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739017010 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739022017 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739054918 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739095926 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739104986 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739121914 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739152908 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739160061 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739178896 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739186049 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739197016 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739206076 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739211082 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739243031 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739259958 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739268064 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739316940 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739322901 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739331007 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739350080 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739376068 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739379883 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739408016 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739422083 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739423990 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739463091 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739468098 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739490986 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739494085 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739535093 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739543915 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739548922 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739588022 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739605904 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739619970 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739622116 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739633083 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739655972 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739686012 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739691973 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739705086 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739723921 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739748001 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739753008 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739773035 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739780903 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739797115 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739823103 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739829063 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739850044 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739865065 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739871979 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739898920 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739903927 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739932060 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739964008 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739965916 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.739974976 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.739995003 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740020990 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740025043 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740039110 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740061045 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740062952 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740087986 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740092993 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740103960 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740113020 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740140915 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740166903 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740176916 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740195036 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740206003 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740219116 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740247965 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740258932 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740269899 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740294933 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740309954 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740317106 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740322113 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740361929 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740379095 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740396976 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740447044 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740449905 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740461111 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740480900 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740503073 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740508080 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.740529060 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.740556955 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.741662025 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.760721922 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.760740042 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.760796070 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.760802031 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.760823011 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.760832071 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.760854959 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.760859966 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.760906935 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.760943890 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.770579100 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.770597935 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.770651102 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.770652056 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.770664930 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.770688057 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.770715952 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.770720959 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.770752907 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.770773888 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.856671095 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.856689930 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.856729984 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.856753111 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.856774092 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.856803894 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.856808901 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:06.856823921 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.856868029 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.857074022 CET	49745	443	192.168.2.4	104.26.1.180
Mar 25, 2025 15:18:06.857085943 CET	443	49745	104.26.1.180	192.168.2.4
Mar 25, 2025 15:18:07.493999958 CET	49681	80	192.168.2.4	2.17.190.73
Mar 25, 2025 15:18:08.006000996 CET	443	49731	172.217.165.132	192.168.2.4
Mar 25, 2025 15:18:08.006083012 CET	443	49731	172.217.165.132	192.168.2.4
Mar 25, 2025 15:18:08.006278992 CET	49731	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:18:09.111040115 CET	49678	443	192.168.2.4	20.189.173.27
Mar 25, 2025 15:18:09.611536980 CET	49731	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:18:09.611584902 CET	443	49731	172.217.165.132	192.168.2.4
Mar 25, 2025 15:18:10.100198984 CET	49671	443	192.168.2.4	204.79.197.203
Mar 25, 2025 15:18:12.321562052 CET	49681	80	192.168.2.4	2.17.190.73
Mar 25, 2025 15:18:18.719476938 CET	49678	443	192.168.2.4	20.189.173.27
Mar 25, 2025 15:18:21.923706055 CET	49681	80	192.168.2.4	2.17.190.73
Mar 25, 2025 15:18:40.243999004 CET	49714	80	192.168.2.4	142.251.40.131
Mar 25, 2025 15:18:40.244004011 CET	49716	80	192.168.2.4	199.232.210.172
Mar 25, 2025 15:18:40.244062901 CET	49718	80	192.168.2.4	199.232.210.172
Mar 25, 2025 15:18:40.337264061 CET	80	49718	199.232.210.172	192.168.2.4
Mar 25, 2025 15:18:40.337325096 CET	80	49718	199.232.210.172	192.168.2.4
Mar 25, 2025 15:18:40.337379932 CET	49718	80	192.168.2.4	199.232.210.172
Mar 25, 2025 15:18:40.338032007 CET	80	49716	199.232.210.172	192.168.2.4
Mar 25, 2025 15:18:40.338093996 CET	80	49716	199.232.210.172	192.168.2.4
Mar 25, 2025 15:18:40.338133097 CET	80	49714	142.251.40.131	192.168.2.4
Mar 25, 2025 15:18:40.338154078 CET	49716	80	192.168.2.4	199.232.210.172
Mar 25, 2025 15:18:40.338331938 CET	49714	80	192.168.2.4	142.251.40.131
Mar 25, 2025 15:18:40.888421059 CET	49715	443	192.168.2.4	23.33.40.150
Mar 25, 2025 15:18:40.888683081 CET	49717	80	192.168.2.4	199.232.210.172
Mar 25, 2025 15:18:40.888794899 CET	49719	80	192.168.2.4	23.13.145.132
Mar 25, 2025 15:18:57.682291031 CET	49751	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:18:57.682380915 CET	443	49751	172.217.165.132	192.168.2.4
Mar 25, 2025 15:18:57.682459116 CET	49751	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:18:57.682585001 CET	49751	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:18:57.682621956 CET	443	49751	172.217.165.132	192.168.2.4
Mar 25, 2025 15:18:57.888438940 CET	443	49751	172.217.165.132	192.168.2.4
Mar 25, 2025 15:18:57.888858080 CET	49751	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:18:57.888874054 CET	443	49751	172.217.165.132	192.168.2.4
Mar 25, 2025 15:19:07.887655973 CET	443	49751	172.217.165.132	192.168.2.4
Mar 25, 2025 15:19:07.887727976 CET	443	49751	172.217.165.132	192.168.2.4
Mar 25, 2025 15:19:07.887810946 CET	49751	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:19:09.614485979 CET	49751	443	192.168.2.4	172.217.165.132
Mar 25, 2025 15:19:09.614552975 CET	443	49751	172.217.165.132	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 25, 2025 15:17:53.703119993 CET	53	63015	1.1.1.1	192.168.2.4
Mar 25, 2025 15:17:53.712311029 CET	53	64189	1.1.1.1	192.168.2.4
Mar 25, 2025 15:17:54.969791889 CET	53	57654	1.1.1.1	192.168.2.4
Mar 25, 2025 15:17:57.620990038 CET	56946	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:17:57.621401072 CET	65279	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:17:57.762306929 CET	53	65279	1.1.1.1	192.168.2.4
Mar 25, 2025 15:17:57.765711069 CET	53	56946	1.1.1.1	192.168.2.4
Mar 25, 2025 15:17:59.096776009 CET	54091	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:17:59.097358942 CET	62903	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:17:59.301278114 CET	53	62903	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:00.122117996 CET	52352	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:18:00.292234898 CET	53	52352	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:01.393743992 CET	55735	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:18:01.394058943 CET	53988	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:18:01.502959013 CET	53	55735	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:01.520056009 CET	53	53988	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:01.620384932 CET	53	62525	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:02.074945927 CET	64864	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:18:02.075222969 CET	51508	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:18:02.195333958 CET	53	64864	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:02.212302923 CET	53	51508	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:05.322695017 CET	54195	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:18:05.323879957 CET	50460	53	192.168.2.4	1.1.1.1
Mar 25, 2025 15:18:05.517661095 CET	53	54195	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:05.577636003 CET	53	50460	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:11.986735106 CET	53	59111	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:30.725620985 CET	53	51868	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:53.134273052 CET	53	50906	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:53.419749022 CET	53	57783	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:56.052130938 CET	53	49714	1.1.1.1	192.168.2.4
Mar 25, 2025 15:18:59.155664921 CET	138	138	192.168.2.4	192.168.2.255

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 25, 2025 15:17:53.728580952 CET	192.168.2.4	1.1.1.1	c233	(Port unreachable)	Destination Unreachable
Mar 25, 2025 15:18:05.577749968 CET	192.168.2.4	1.1.1.1	c24c	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 25, 2025 15:17:57.620990038 CET	192.168.2.4	1.1.1.1	0x74da	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:17:57.621401072 CET	192.168.2.4	1.1.1.1	0x7a6d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 25, 2025 15:17:59.096776009 CET	192.168.2.4	1.1.1.1	0x2d79	Standard query (0)	lawful-lamontagne-7e83y.zipwp.top	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:17:59.097358942 CET	192.168.2.4	1.1.1.1	0x7eea	Standard query (0)	lawful-lamontagne-7e83y.zipwp.top	65	IN (0x0001)	false
Mar 25, 2025 15:18:00.122117996 CET	192.168.2.4	1.1.1.1	0x2d0	Standard query (0)	lawful-lamontagne-7e83y.zipwp.top	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:01.393743992 CET	192.168.2.4	1.1.1.1	0x39b5	Standard query (0)	zipwp.com	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:01.394058943 CET	192.168.2.4	1.1.1.1	0xb87	Standard query (0)	zipwp.com	65	IN (0x0001)	false
Mar 25, 2025 15:18:02.074945927 CET	192.168.2.4	1.1.1.1	0xdb5c	Standard query (0)	zipwp.com	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:02.075222969 CET	192.168.2.4	1.1.1.1	0x8698	Standard query (0)	zipwp.com	65	IN (0x0001)	false
Mar 25, 2025 15:18:05.322695017 CET	192.168.2.4	1.1.1.1	0x7285	Standard query (0)	lawful-lamontagne-7e83y.zipwp.top	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:05.323879957 CET	192.168.2.4	1.1.1.1	0x25e	Standard query (0)	lawful-lamontagne-7e83y.zipwp.top	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 25, 2025 15:17:57.762306929 CET	1.1.1.1	192.168.2.4	0x7a6d	No error (0)	www.google.com		65	IN (0x0001)	false
Mar 25, 2025 15:17:57.765711069 CET	1.1.1.1	192.168.2.4	0x74da	No error (0)	www.google.com	172.217.165.132	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:00.292234898 CET	1.1.1.1	192.168.2.4	0x2d0	No error (0)	lawful-lamontagne-7e83y.zipwp.top	148.135.1.141	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:01.502959013 CET	1.1.1.1	192.168.2.4	0x39b5	No error (0)	zipwp.com	104.26.1.180	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:01.502959013 CET	1.1.1.1	192.168.2.4	0x39b5	No error (0)	zipwp.com	104.26.0.180	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:01.502959013 CET	1.1.1.1	192.168.2.4	0x39b5	No error (0)	zipwp.com	172.67.72.169	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:01.520056009 CET	1.1.1.1	192.168.2.4	0xb87	No error (0)	zipwp.com		65	IN (0x0001)	false
Mar 25, 2025 15:18:02.195333958 CET	1.1.1.1	192.168.2.4	0xdb5c	No error (0)	zipwp.com	104.26.1.180	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:02.195333958 CET	1.1.1.1	192.168.2.4	0xdb5c	No error (0)	zipwp.com	172.67.72.169	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:02.195333958 CET	1.1.1.1	192.168.2.4	0xdb5c	No error (0)	zipwp.com	104.26.0.180	A (IP address)	IN (0x0001)	false
Mar 25, 2025 15:18:02.212302923 CET	1.1.1.1	192.168.2.4	0x8698	No error (0)	zipwp.com		65	IN (0x0001)	false
Mar 25, 2025 15:18:05.517661095 CET	1.1.1.1	192.168.2.4	0x7285	No error (0)	lawful-lamontagne-7e83y.zipwp.top	148.135.1.141	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

lawful-lamontagne-7e83y.zipwp.top

zipwp.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	148.135.1.141	443	5052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:18:00 UTC	712	OUT	GET /zipwp-login-67e2afa011731.php HTTP/1.1 Host: lawful-lamontagne-7e83y.zipwp.top Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 14:18:01 UTC	279	IN	HTTP/1.1 200 OK Server: nginx-rc Date: Tue, 25 Mar 2025 14:18:01 GMT Content-Type: text/html Content-Length: 5606 Last-Modified: Thu, 28 Nov 2024 12:32:31 GMT Connection: close Vary: Accept-Encoding ETag: "674862df-15e6" Content-Type: text/html Accept-Ranges: bytes
2025-03-25 14:18:01 UTC	5606	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Verification</title> <style type="text/css"> body { margin: 0; }

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	104.26.1.180	443	5052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:18:01 UTC	647	OUT	GET /images/lock-icon.svg HTTP/1.1 Host: zipwp.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://lawful-lamontagne-7e83y.zipwp.top/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 14:18:02 UTC	1105	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 14:18:01 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close CF-Ray: 925f09023d2e7d05-EWR CF-Cache-Status: HIT Age: 21694 Cache-Control: max-age=2592000 ETag: W/"67375084-29b" Expires: Thu, 24 Apr 2025 08:16:27 GMT Last-Modified: Fri, 15 Nov 2024 13:45:40 GMT Vary: Accept-Encoding x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-runcache-type: srcache x-runcloud-srcache-fetch: BYPASS x-runcloud-srcache-store: BYPASS x-xss-protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NhD1lDh2b7Opug24DJg6mrJi0Qu%2BAo%2FEv2HUmIDfCsFuyLty094AuHPssGQsfdeq4pSaPeqk1MCmgb8be6CNM4jPMKbbxyo6jT2S7LqECMNijeVD8SQAiPCSMw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=110058&min_rtt=100815&rtt_var=30899&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2818&recv_bytes=1219&delivery_rate=36852&cwnd=223&unsent_bytes=0&cid=255239e0ad1911e6&ts=296&x=0"
2025-03-25 14:18:02 UTC	264	IN	Data Raw: 32 39 62 0d 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 32 32 20 31 34 56 39 43 32 32 20 35 2e 36 38 36 32 39 20 31 39 2e 33 31 33 37 20 33 20 31 36 20 33 43 31 32 2e 36 38 36 33 20 33 20 31 30 20 35 2e 36 38 36 32 39 20 31 30 20 39 56 31 34 4d 39 20 32 39 48 32 33 43 32 34 2e 36 35 36 39 20 32 39 20 32 36 20 32 37 2e 36 35 36 39 20 32 36 20 32 36 56 31 37 43 32 36 20 31 35 2e 33 34 33 31 20 32 34 2e 36 35 36 39 20 31 34 20 32 33 20 31 34 48 39 43 37 2e 33 34 33 31 35 20 31 34 20 36 Data Ascii: 29b<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M22 14V9C22 5.68629 19.3137 3 16 3C12.6863 3 10 5.68629 10 9V14M9 29H23C24.6569 29 26 27.6569 26 26V17C26 15.3431 24.6569 14 23 14H9C7.34315 14 6
2025-03-25 14:18:02 UTC	410	IN	Data Raw: 36 20 31 37 56 32 36 43 36 20 32 37 2e 36 35 36 39 20 37 2e 33 34 33 31 35 20 32 39 20 39 20 32 39 5a 22 20 73 74 72 6f 6b 65 3d 22 75 72 6c 28 23 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 31 39 32 31 37 5f 32 32 34 36 32 29 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 2f 3e 0a 3c 64 65 66 73 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 31 39 32 31 37 5f 32 32 34 36 32 22 20 78 31 3d 22 36 22 20 79 31 3d 22 31 36 22 20 78 32 3d 22 32 36 22 20 79 32 3d 22 31 36 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 Data Ascii: 6 17V26C6 27.6569 7.34315 29 9 29Z" stroke="url(#paint0_linear_19217_22462)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/><defs><linearGradient id="paint0_linear_19217_22462" x1="6" y1="16" x2="26" y2="16" gradientUnits="userSpaceOnU
2025-03-25 14:18:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	104.26.1.180	443	5052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:18:02 UTC	393	OUT	GET /images/lock-icon.svg HTTP/1.1 Host: zipwp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 14:18:02 UTC	1106	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 14:18:02 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: close CF-Ray: 925f0907092e5e7e-EWR CF-Cache-Status: HIT Age: 21695 Cache-Control: max-age=2592000 ETag: W/"67375084-29b" Expires: Thu, 24 Apr 2025 08:16:27 GMT Last-Modified: Fri, 15 Nov 2024 13:45:40 GMT Vary: Accept-Encoding x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-runcache-type: srcache x-runcloud-srcache-fetch: BYPASS x-runcloud-srcache-store: BYPASS x-xss-protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wwLCv7wS6T0hG9Jp1H8culljAngVYmtP6yAoqeboovU31xHQ0FCo3X99Lzp55Vy0JLgy7KFTPj19XdnrfXWsWtg09PBAVSAuYOY8S2Fav%2FwEeA%2F%2FJ1O6f82b1w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=135990&min_rtt=133145&rtt_var=31019&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2819&recv_bytes=965&delivery_rate=27962&cwnd=230&unsent_bytes=0&cid=72f1d3781f188fc6&ts=348&x=0"
2025-03-25 14:18:02 UTC	263	IN	Data Raw: 32 39 62 0d 0a 3c 73 76 67 20 77 69 64 74 68 3d 22 33 32 22 20 68 65 69 67 68 74 3d 22 33 32 22 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 33 32 20 33 32 22 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 3e 0a 3c 70 61 74 68 20 64 3d 22 4d 32 32 20 31 34 56 39 43 32 32 20 35 2e 36 38 36 32 39 20 31 39 2e 33 31 33 37 20 33 20 31 36 20 33 43 31 32 2e 36 38 36 33 20 33 20 31 30 20 35 2e 36 38 36 32 39 20 31 30 20 39 56 31 34 4d 39 20 32 39 48 32 33 43 32 34 2e 36 35 36 39 20 32 39 20 32 36 20 32 37 2e 36 35 36 39 20 32 36 20 32 36 56 31 37 43 32 36 20 31 35 2e 33 34 33 31 20 32 34 2e 36 35 36 39 20 31 34 20 32 33 20 31 34 48 39 43 37 2e 33 34 33 31 35 20 31 34 20 36 Data Ascii: 29b<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M22 14V9C22 5.68629 19.3137 3 16 3C12.6863 3 10 5.68629 10 9V14M9 29H23C24.6569 29 26 27.6569 26 26V17C26 15.3431 24.6569 14 23 14H9C7.34315 14 6
2025-03-25 14:18:02 UTC	411	IN	Data Raw: 20 36 20 31 37 56 32 36 43 36 20 32 37 2e 36 35 36 39 20 37 2e 33 34 33 31 35 20 32 39 20 39 20 32 39 5a 22 20 73 74 72 6f 6b 65 3d 22 75 72 6c 28 23 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 31 39 32 31 37 5f 32 32 34 36 32 29 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 63 61 70 3d 22 72 6f 75 6e 64 22 20 73 74 72 6f 6b 65 2d 6c 69 6e 65 6a 6f 69 6e 3d 22 72 6f 75 6e 64 22 2f 3e 0a 3c 64 65 66 73 3e 0a 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 70 61 69 6e 74 30 5f 6c 69 6e 65 61 72 5f 31 39 32 31 37 5f 32 32 34 36 32 22 20 78 31 3d 22 36 22 20 79 31 3d 22 31 36 22 20 78 32 3d 22 32 36 22 20 79 32 3d 22 31 36 22 20 67 72 61 64 69 65 6e 74 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e Data Ascii: 6 17V26C6 27.6569 7.34315 29 9 29Z" stroke="url(#paint0_linear_19217_22462)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/><defs><linearGradient id="paint0_linear_19217_22462" x1="6" y1="16" x2="26" y2="16" gradientUnits="userSpaceOn
2025-03-25 14:18:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	104.26.1.180	443	5052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:18:03 UTC	648	OUT	GET /images/site-image.png HTTP/1.1 Host: zipwp.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://lawful-lamontagne-7e83y.zipwp.top/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 14:18:04 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 14:18:03 GMT Content-Type: image/png Content-Length: 938994 Connection: close CF-Ray: 925f090ebf16c40c-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Age: 15840 Cache-Control: max-age=2592000 ETag: "67375084-e53f2" Expires: Thu, 24 Apr 2025 09:54:03 GMT Last-Modified: Fri, 15 Nov 2024 13:45:40 GMT Vary: Accept-Encoding x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-runcache-type: srcache x-runcloud-srcache-fetch: BYPASS x-runcloud-srcache-store: BYPASS x-xss-protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MHTBMj71rbeESby%2B5wCRwmP4cFhXDTAtr0FZNUTs52BFbAqK6dB1B1Ee26EmCYHeSIi07YGUCp6OaUQL4jMDQFfF177568Khkbx%2BQTbjAQXiBl4H2ns%2BQtI%2FIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=135754&min_rtt=119000&rtt_var=45969&sent=11&recv=8&lost=0&retrans=5&sent_bytes=8124&recv_bytes=1220&delivery_rate=9604&cwnd=250&unsent_bytes=0&cid=9916f7dde23b7589&ts=2262&x=0"
2025-03-25 14:18:04 UTC	245	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 b0 00 00 04 38 08 06 00 00 00 19 c2 25 7a 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 0e 53 87 49 44 41 54 78 01 cc fd 6b 96 23 b9 8e 2d 0c 02 26 45 9e 75 bb bf 5f 3d 82 9e ff 00 7b 55 65 b8 0c 2d 12 d8 c0 06 8d 26 f7 38 8f ba c5 4c 0f 49 66 7c 80 20 88 17 49 50 ff cf ff e7 ff 6b f2 4e aa 2a 33 99 f9 c7 78 26 4b d2 cb 93 6f d3 5d 09 7b b7 63 4b bb 78 76 fc a4 9d c8 33 ca a0 0e 5d de e1 bd 7f a9 b6 f2 59 bd b8 ef 2b e1 63 e9 c0 25 bf 52 3e 7c 47 5b ba d6 a9 c7 cc 61 86 c7 3a 3f 3d bb 45 39 2d fc 2c 79 f1 8c 1e ca f2 e6 73 02 fc 0b dc fe a8 e3 0f 38 ce be 6c c6 67 Data Ascii: PNGIHDR8%zpHYssRGBgAMAaSIDATxk#-&Eu_={Ue-&8LIf\| IPkN*3x&Ko]{cKxv3]Y+c%R>\|G[a:?=E9-,ys8lg
2025-03-25 14:18:04 UTC	1369	IN	Data Raw: f7 8c f1 ac bb 31 89 e7 ba 1d 6f 15 8c 4a 8e af 5e cb 33 8c b7 a9 0f a5 80 ba 0b 97 fe bb ea b0 5e 30 da 2e 5a 63 78 4d ce d3 e4 f1 78 2c 63 27 97 b2 77 a0 e9 4a cb b3 80 03 7c 1c c7 ac f7 38 62 9c 82 8e 17 08 b2 fe f1 79 9e 27 b5 7d c5 fb 85 46 46 3b 6f 7a 1c 6d a9 be fb 12 df e7 33 ad f9 78 be 5e 01 cb b1 b0 02 9d f0 f9 38 bc f3 d9 99 30 1c c7 e3 4d ea 47 b6 ef 7d 8c 3a c6 fb f7 3f bf 7e fd 92 bf fe fa 4b 9e 87 d7 f3 7c 97 69 30 8f 72 ef 7c bf bf bc fd ff df 7f fd 97 fc fe fd f5 6e c7 f9 c5 eb 1c cf df 38 99 30 c8 6c fb 0c 3c 9c 16 a8 8c 71 f1 bf f3 42 73 63 3a 3a 56 b5 e1 ce e9 5e a2 2f c7 95 5e 4d b6 b8 f7 61 f4 fa d6 b6 1e 63 2c 81 ef c0 a5 c3 fd 7a f7 c5 cb f3 18 ae 3c 2c f9 84 76 da 19 65 aa 8f 7d ce 3a 6f f5 ff 5a 02 1b 08 5c ae fc 4e e9 87 51 37 Data Ascii: 1oJ^3^0.ZcxMx,c'wJ\|8by'}FF;ozm3x^80MG}:?~K\|i0r\|n80l<qBsc::V^/^Mac,z<,ve}:oZ\NQ7
2025-03-25 14:18:04 UTC	1369	IN	Data Raw: 64 07 01 51 34 0f dc 4e 27 c5 5b 39 ff 7a cf f9 bf 1f 6f 03 fd 6d 88 fc f7 cb 3f 1f 61 bc 1c 63 a1 e0 75 06 67 d1 62 7b 39 7e d4 2a 2b 63 a1 5c 61 1e 32 ef 9c 46 9c 54 f9 52 c4 0a 59 4e 6f 5e 21 e6 33 f7 0f 2c f8 4e 09 ed 06 cd 4f 06 aa f7 83 0d 74 d5 8e d6 9e 77 99 ff c4 07 8d de 5f d5 0b ad 36 24 1c 56 f1 87 bc af 69 08 bd 02 1f e5 e0 82 13 f5 8c 56 86 e1 c4 c6 b2 06 de d8 09 3f 1d 5f 83 e9 4c 47 95 ca ef 00 f5 7c ff fe 7a 97 ff ef 51 f7 98 e7 a3 45 8b f6 e6 77 37 c2 ac 03 2f 65 80 e2 a9 f7 7b 98 4e 47 38 26 24 21 72 7e 77 44 71 5e d4 b1 98 eb 3a 1c 2b 09 ae 42 e0 a6 01 0b 07 17 f3 6e c8 e4 6c 67 e1 7b ac 3b 4d e7 39 39 bf f9 39 3b b4 e0 88 02 26 87 3c 4c fa 5c 12 78 fc 18 89 f3 0c 1e 49 3c 6f b7 58 00 83 72 d5 d3 d6 f9 01 e7 70 92 de 79 36 1d 76 7e 1e Data Ascii: dQ4N'[9zom?acugb{9~*+c\a2FTRYNo^!3,NOtw_6$ViV?_LG\|zQEw7/e{NG8&$!r~wDq^:+Bnlg{;M999;&<L\xI<oXrpy6v~
2025-03-25 14:18:04 UTC	423	IN	Data Raw: 4a d2 be c3 86 d3 03 07 e9 0e 02 dd 50 ba 81 9d ba 2c c1 d4 f4 77 71 07 bb 06 ae 20 bb 81 e7 75 07 e6 5d 82 0e 8f 19 85 ba a3 83 79 e2 a2 c6 f8 fd ff 19 f4 6a a1 8b a6 ce 8f d2 2e c3 93 67 98 c8 aa a1 ac 7d 95 9b 5f c3 b1 78 58 f5 0b 79 d0 df 43 8b 9b 4e 3a 92 d0 61 0f 8b 05 ee d3 e1 3c 03 d7 41 0c ec f8 c0 89 8c f1 fe 94 93 b1 2e 57 db ce ba 6d 41 b2 3d 61 de 2b 15 4b 1f ee 9f c1 c1 ca 38 07 4f 05 ad 88 f6 76 2c 70 8e ec b2 1b 76 ae ef 43 9a fd 83 de a7 05 93 2d f6 ea d6 59 c7 fc 6f c9 b5 d7 52 97 84 f6 4c 43 be 58 ab e5 ce 49 c8 e5 77 f8 6c 63 a4 c4 0f 0b b8 b0 ef 34 7f 33 9e d3 81 56 1d dd b6 fd dc 32 c1 50 26 c4 ee 11 70 c7 b8 2f c6 eb ee 5d d4 6d f2 89 d1 db 95 c9 15 dc 97 ef 6b 2d 7c 24 06 86 69 53 30 59 e9 40 7b a8 6f 15 46 04 8f 2e 78 01 43 69 f8 Data Ascii: JP,wq u]yj.g}_xXyCN:a<A.WmA=a+K8Ov,pvC-YoRLCXIwlc43V2P&p/]mk-\|$iS0Y@{oF.xCi
2025-03-25 14:18:04 UTC	1369	IN	Data Raw: b9 b2 1f 8e cf af b7 01 f5 fb f7 6f cf 77 68 32 6c 79 69 eb 0f 24 4a 75 1b f0 1c 35 5f 64 61 2f 18 03 ad 79 97 4e 2a 52 54 0e da ed 91 7c 81 ea c0 18 89 28 e5 67 78 6a a5 d4 77 32 bc 42 81 3c fc 18 63 b4 7f 10 af d4 38 fc e2 70 9d a4 04 77 43 68 f7 5d 18 05 cc 43 52 ad b4 38 72 53 1c 69 c9 da aa e0 b4 cd 63 f6 2d 3f d9 1d 9b e1 72 53 21 5c 8e c1 3e 95 8c ae d8 fd 31 95 ad 13 1c 9d e6 ba 33 e5 66 1c e2 78 25 c3 36 c0 bb f2 10 18 54 9d 96 0d 7f a9 24 da 85 3f 65 3d 3b a6 bd e9 67 ca 08 61 e6 74 cf 83 ef d2 85 95 fc 51 4d 2b 8c 7f de fe 8f ea 57 fe d9 75 04 cc 23 77 9a ab fc b7 fc 1d ce 13 38 7c c6 ea f5 f3 6d 14 eb 3c 3a a1 2f 9f a7 c3 bb fe 8c e3 02 7e 8c 5a 4a 46 73 8f 30 56 a7 a4 52 58 72 f3 f0 63 55 90 d9 4c 1f 63 6e 9c 92 c6 4d ea 0f 86 f9 6f 39 59 06 Data Ascii: owh2lyi$Ju5_da/yN*RT\|(gxjw2B<c8pwCh]CR8rSic-?rS!\>13fx%6T$?e=;gatQM+Wu#w8\|m<:/~ZJFs0VRXrcULcnMo9Y
2025-03-25 14:18:04 UTC	1369	IN	Data Raw: 77 c4 bf 72 dc 69 ac 8b 0e a3 89 28 38 e1 81 11 19 db 15 98 7f 0b ea 46 59 d5 3c 0a ee 7d 09 23 30 f8 ea aa 14 9f c4 83 91 2f 9d 79 80 23 3a e6 cf cf ca 37 e4 d4 c3 65 ef 58 7c 78 7b 35 72 b7 d5 70 52 bd 97 22 e2 b7 cc 63 ea 73 97 d5 8c 73 e5 3c b6 dc 81 c5 a3 c6 33 3d 57 07 9e 66 dc 33 38 e4 0d 32 09 fd 96 a0 ba 88 0b 74 84 ac d7 c8 9b 66 ca 51 38 83 11 58 f3 db 26 cf 19 e9 65 e5 94 82 61 8e 9d d4 b3 2d a3 5d 81 c4 2f 40 5b ec 48 b2 25 df 74 d8 3f 9f d5 67 3a 6e 08 3d 07 7a 8d 68 2d 6e 41 df 42 cc b2 07 ed f4 3d 97 b0 16 f3 fd 90 e3 01 8b 2e d4 3a 1d 32 41 64 8a 5d 88 64 1c 69 c4 9c d4 ec 8f 3b 93 e7 0e ac 38 2e 08 a7 95 ef be f2 dd 56 33 4c 40 c4 be 02 bf 72 d9 13 4e 10 a9 3e 1e 87 f6 fe 06 fc 7c ec 7b 3c 82 da b7 ea b9 57 fd 94 df 47 97 8e 7e b4 39 ba Data Ascii: wri(8FY<}#0/y#:7eX\|x{5rpR"css<3=Wf382tfQ8X&ea-]/@[H%t?g:n=zh-nAB=.:2Ad]di;8.V3L@rN>\|{<WG~9
2025-03-25 14:18:04 UTC	1369	IN	Data Raw: 0f 9e 36 e3 c8 0d 39 42 3c e9 20 c0 fc b7 ce 98 8f 16 3a 33 18 31 78 23 4d 95 40 ce 27 9a 08 b4 27 0c 92 fd 4f fa b3 1a df 74 76 45 1f 84 f9 0a 1c e4 76 42 08 05 20 95 a7 d3 79 52 a3 f0 c7 0a 6b 16 61 a1 9e ec b7 08 00 8e 98 d4 05 97 b9 f7 6d 9a 24 71 75 fa dc a5 95 6e 2c 68 ea 8f 59 05 a3 84 69 05 ef ac b7 91 8e a1 95 df 19 7d ee 70 b6 a6 4d bd f8 de c0 d3 4d 5b bb ea d2 46 55 a2 75 cd 77 e0 13 9b 4e 5d ea f9 c9 b8 41 2e 3c b3 f1 60 9c 97 49 7a 5f 43 cb 7b ab c4 5b 53 43 5a fe ec ca 8d 82 3f df eb 5e 11 ff 2e d9 1d 1c 5c 1f 94 02 91 3c db 7c 99 31 66 cd c1 a2 7b 28 fb 13 65 2a b4 ca 97 42 3a 3e b7 04 cf 38 ad ba 1a 8f 04 2c 41 10 5d e1 35 82 e1 9f 4b 3b c5 ab 41 b8 33 38 eb ed 6d b9 a8 bd 39 b6 8a 49 f1 96 f6 b3 d5 f5 13 78 e1 4d 5e 9f ff 09 1e f6 63 11 Data Ascii: 69B< :31x#M@''OtvEvB yRkam$qun,hYi}pMM[FUuwN]A.<`Iz_C{[SCZ?^.\<\|1f{(e*B:>8,A]5K;A38m9IxM^c
2025-03-25 14:18:04 UTC	1369	IN	Data Raw: 8e 0d 42 38 b8 7e 77 fa 15 f2 87 d2 e8 15 2f 98 3b b6 22 90 88 0a 68 21 f0 1c 63 33 9d 7f 6f 6b 7e 18 f7 a7 5d c7 fa 53 ba 15 c0 8a 71 ff 48 c8 4b 76 bd 18 5a b7 ed 2e bc f1 bb 54 ab 35 31 2e 52 47 6f ba c1 01 07 62 f1 1b 2b f6 91 57 40 03 06 3e ba d8 0d 4d a3 ee f6 40 b1 12 e3 6d a1 88 59 01 59 dc fb 3b fc 13 60 24 8b 85 9a bf 16 19 8f 63 4e 44 6f f2 05 f0 3f 3f 06 4c 1b d9 f7 11 a2 db 97 80 ee 0a 65 57 05 76 5a 8d 8a fc 40 72 eb f2 f9 89 ca c6 5c fc fd 9e 2f c3 89 35 6e 70 72 d5 b9 f0 30 56 ea 87 63 78 78 b7 8e 79 b5 9c 65 9c 91 06 b8 60 8c 9c c7 f7 95 db 82 dd e8 4a 2b 9b bc e4 2a 6f aa d7 bc a3 55 ba f2 68 d6 75 2a dd c8 31 a3 be a7 de 53 b2 41 16 45 0e 32 0c fd 60 e9 b8 6a 0f 27 78 6f d2 7b 77 80 78 8c ab 33 70 e1 a5 4e 53 c9 f0 7a 46 c7 38 4e 6b 0d Data Ascii: B8~w/;"h!c3ok~]SqHKvZ.T51.RGob+W@>M@mYY;`$cNDo??LeWvZ@r\/5npr0Vcxxye`J+oUhu1SAE2`j'xo{wx3pNSzF8Nk
2025-03-25 14:18:04 UTC	1369	IN	Data Raw: d8 f8 f1 a3 f7 6c fc ef f5 a1 55 67 f3 71 5f f8 39 e4 28 5a e2 05 23 ca 2f 11 ef 8f 6f b9 6d ed 2c 7a 17 07 73 67 43 f7 5a 36 5a 0a 3a f5 98 36 90 ad ea 8b 36 23 de d5 43 3c 06 56 c4 bd 4a 27 42 c8 66 57 02 a0 21 8a 5c 34 f7 c6 0f 59 7f c5 ae ee be 00 41 05 65 e5 4e a5 ff 49 6f 83 cb 0d 9c 1b 3d 53 72 36 a4 9e 27 69 a8 31 9e f6 8e bf 9a fb 2b df 6f f5 29 93 8d 35 b8 9a a6 0b 3a 90 85 6d 86 82 ca fc be 5f 0a 51 25 b8 dd 06 8f 68 93 3a 4a 70 df db 0b 92 7c 2e 75 2f 9f 26 e9 88 2e a7 7e 97 33 d0 39 b7 5c 31 74 56 33 93 e6 da 8c af ce af 48 87 1a ef 16 7c 01 ee 47 c4 69 7d b4 79 a7 17 dd a6 f1 5e 91 d0 09 b5 e9 14 89 fb 85 66 12 e7 f8 2d 92 17 1b 5d 3a 08 9e 90 fa ef 49 8c 07 f9 ab 3e f0 2b fc 56 e9 a3 67 7c a4 18 0c 5e 3e e3 74 cb 78 08 3e 49 fc 1d 00 78 ad Data Ascii: lUgq_9(Z#/om,zsgCZ6Z:66#C<VJ'BfW!\4YAeNIo=Sr6'i1+o)5:m_Q%h:Jp\|.u/&.~39\1tV3H\|Gi}y^f-]:I>+Vg\|^>tx>Ix
2025-03-25 14:18:04 UTC	1369	IN	Data Raw: fe dd fb b5 fe 7f 16 1e b4 81 36 b1 92 53 78 b8 8e aa 2e cb ea 8d 40 bb ee 90 f5 e6 74 22 05 ad da 87 78 ea 93 6b 8d db b0 5b fd 4a 06 af fd c6 9f 0e 6b f5 53 9b f0 06 6c 72 e9 23 28 6d b5 4b cd 50 6f 7d 16 5c e8 e3 ca 65 e4 1b a6 61 25 1c 23 9d cb ad 4b 68 db f8 e6 ab 1d e4 1b da 2d fc ca 65 1e b3 43 e0 a0 f2 f3 d9 3c d6 f6 68 f5 8c bf 23 15 d7 47 c2 09 c5 95 3b 8c a3 7b a1 a5 b9 50 84 30 0e 03 09 46 14 56 d7 6a 47 83 ff e1 b6 3d dc f0 07 ba f4 80 9d 0f 5f e9 f9 75 4c e3 f5 11 b7 1e 29 b7 3b 83 3f 3f 43 d9 f1 9d 64 30 fe 3c 40 f1 6b 36 e5 c7 1d fc 7e 8b 19 7b eb 75 96 71 47 ce af 8c b5 40 ab 4b 47 38 39 67 40 e4 b1 8b 2c 8c 3b 38 49 ce b8 5d 11 d7 a0 8f be 1e c3 c6 8e d8 20 8f a3 e2 66 8d 32 08 70 3f 60 7b 7d 7d c9 ef af df 0e cf 59 3b bb b6 e3 6b f6 8d Data Ascii: 6Sx.@t"xk[JkSlr#(mKPo}\ea%#Kh-eC<h#G;{P0FVjG=_uL);??Cd0<@k6~{uqG@KG89g@,;8I] f2p?`{}}Y;k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	148.135.1.141	443	5052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:18:05 UTC	658	OUT	GET /favicon.ico HTTP/1.1 Host: lawful-lamontagne-7e83y.zipwp.top Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 14:18:05 UTC	279	IN	HTTP/1.1 200 OK Server: nginx-rc Date: Tue, 25 Mar 2025 14:18:05 GMT Content-Type: text/html Content-Length: 5606 Last-Modified: Thu, 28 Nov 2024 12:32:31 GMT Connection: close Vary: Accept-Encoding ETag: "674862df-15e6" Content-Type: text/html Accept-Ranges: bytes
2025-03-25 14:18:05 UTC	5606	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Verification</title> <style type="text/css"> body { margin: 0; }

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	104.26.1.180	443	5052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:18:05 UTC	394	OUT	GET /images/site-image.png HTTP/1.1 Host: zipwp.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 14:18:05 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 25 Mar 2025 14:18:05 GMT Content-Type: image/png Content-Length: 938994 Connection: close CF-Ray: 925f09194ef742d4-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Age: 15842 Cache-Control: max-age=2592000 ETag: "67375084-e53f2" Expires: Thu, 24 Apr 2025 09:54:03 GMT Last-Modified: Fri, 15 Nov 2024 13:45:40 GMT Vary: Accept-Encoding x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-runcache-type: srcache x-runcloud-srcache-fetch: BYPASS x-runcloud-srcache-store: BYPASS x-xss-protection: 1; mode=block Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KHymihOzNZH2wW7lJqT%2FVEc97IcwrhGdJjehkmxQmi83l%2BZY612DO6DKJGvO%2BUf%2BXtFSuk81YAHAVG9FnupkVASfU4rxP2TCtwEww25%2FZjATyzCy18vb0XI54w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare server-timing: cfL4;desc="?proto=TCP&rtt=138053&min_rtt=136888&rtt_var=30631&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2820&recv_bytes=966&delivery_rate=26529&cwnd=237&unsent_bytes=0&cid=25252643dd864de2&ts=353&x=0"
2025-03-25 14:18:05 UTC	245	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 b0 00 00 04 38 08 06 00 00 00 19 c2 25 7a 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 0e 53 87 49 44 41 54 78 01 cc fd 6b 96 23 b9 8e 2d 0c 02 26 45 9e 75 bb bf 5f 3d 82 9e ff 00 7b 55 65 b8 0c 2d 12 d8 c0 06 8d 26 f7 38 8f ba c5 4c 0f 49 66 7c 80 20 88 17 49 50 ff cf ff e7 ff 6b f2 4e aa 2a 33 99 f9 c7 78 26 4b d2 cb 93 6f d3 5d 09 7b b7 63 4b bb 78 76 fc a4 9d c8 33 ca a0 0e 5d de e1 bd 7f a9 b6 f2 59 bd b8 ef 2b e1 63 e9 c0 25 bf 52 3e 7c 47 5b ba d6 a9 c7 cc 61 86 c7 3a 3f 3d bb 45 39 2d fc 2c 79 f1 8c 1e ca f2 e6 73 02 fc 0b dc fe a8 e3 0f 38 ce be 6c c6 67 Data Ascii: PNGIHDR8%zpHYssRGBgAMAaSIDATxk#-&Eu_={Ue-&8LIf\| IPkN*3x&Ko]{cKxv3]Y+c%R>\|G[a:?=E9-,ys8lg
2025-03-25 14:18:05 UTC	1369	IN	Data Raw: f7 8c f1 ac bb 31 89 e7 ba 1d 6f 15 8c 4a 8e af 5e cb 33 8c b7 a9 0f a5 80 ba 0b 97 fe bb ea b0 5e 30 da 2e 5a 63 78 4d ce d3 e4 f1 78 2c 63 27 97 b2 77 a0 e9 4a cb b3 80 03 7c 1c c7 ac f7 38 62 9c 82 8e 17 08 b2 fe f1 79 9e 27 b5 7d c5 fb 85 46 46 3b 6f 7a 1c 6d a9 be fb 12 df e7 33 ad f9 78 be 5e 01 cb b1 b0 02 9d f0 f9 38 bc f3 d9 99 30 1c c7 e3 4d ea 47 b6 ef 7d 8c 3a c6 fb f7 3f bf 7e fd 92 bf fe fa 4b 9e 87 d7 f3 7c 97 69 30 8f 72 ef 7c bf bf bc fd ff df 7f fd 97 fc fe fd f5 6e c7 f9 c5 eb 1c cf df 38 99 30 c8 6c fb 0c 3c 9c 16 a8 8c 71 f1 bf f3 42 73 63 3a 3a 56 b5 e1 ce e9 5e a2 2f c7 95 5e 4d b6 b8 f7 61 f4 fa d6 b6 1e 63 2c 81 ef c0 a5 c3 fd 7a f7 c5 cb f3 18 ae 3c 2c f9 84 76 da 19 65 aa 8f 7d ce 3a 6f f5 ff 5a 02 1b 08 5c ae fc 4e e9 87 51 37 Data Ascii: 1oJ^3^0.ZcxMx,c'wJ\|8by'}FF;ozm3x^80MG}:?~K\|i0r\|n80l<qBsc::V^/^Mac,z<,ve}:oZ\NQ7
2025-03-25 14:18:05 UTC	1369	IN	Data Raw: 64 07 01 51 34 0f dc 4e 27 c5 5b 39 ff 7a cf f9 bf 1f 6f 03 fd 6d 88 fc f7 cb 3f 1f 61 bc 1c 63 a1 e0 75 06 67 d1 62 7b 39 7e d4 2a 2b 63 a1 5c 61 1e 32 ef 9c 46 9c 54 f9 52 c4 0a 59 4e 6f 5e 21 e6 33 f7 0f 2c f8 4e 09 ed 06 cd 4f 06 aa f7 83 0d 74 d5 8e d6 9e 77 99 ff c4 07 8d de 5f d5 0b ad 36 24 1c 56 f1 87 bc af 69 08 bd 02 1f e5 e0 82 13 f5 8c 56 86 e1 c4 c6 b2 06 de d8 09 3f 1d 5f 83 e9 4c 47 95 ca ef 00 f5 7c ff fe 7a 97 ff ef 51 f7 98 e7 a3 45 8b f6 e6 77 37 c2 ac 03 2f 65 80 e2 a9 f7 7b 98 4e 47 38 26 24 21 72 7e 77 44 71 5e d4 b1 98 eb 3a 1c 2b 09 ae 42 e0 a6 01 0b 07 17 f3 6e c8 e4 6c 67 e1 7b ac 3b 4d e7 39 39 bf f9 39 3b b4 e0 88 02 26 87 3c 4c fa 5c 12 78 fc 18 89 f3 0c 1e 49 3c 6f b7 58 00 83 72 d5 d3 d6 f9 01 e7 70 92 de 79 36 1d 76 7e 1e Data Ascii: dQ4N'[9zom?acugb{9~*+c\a2FTRYNo^!3,NOtw_6$ViV?_LG\|zQEw7/e{NG8&$!r~wDq^:+Bnlg{;M999;&<L\xI<oXrpy6v~
2025-03-25 14:18:05 UTC	1369	IN	Data Raw: 4a d2 be c3 86 d3 03 07 e9 0e 02 dd 50 ba 81 9d ba 2c c1 d4 f4 77 71 07 bb 06 ae 20 bb 81 e7 75 07 e6 5d 82 0e 8f 19 85 ba a3 83 79 e2 a2 c6 f8 fd ff 19 f4 6a a1 8b a6 ce 8f d2 2e c3 93 67 98 c8 aa a1 ac 7d 95 9b 5f c3 b1 78 58 f5 0b 79 d0 df 43 8b 9b 4e 3a 92 d0 61 0f 8b 05 ee d3 e1 3c 03 d7 41 0c ec f8 c0 89 8c f1 fe 94 93 b1 2e 57 db ce ba 6d 41 b2 3d 61 de 2b 15 4b 1f ee 9f c1 c1 ca 38 07 4f 05 ad 88 f6 76 2c 70 8e ec b2 1b 76 ae ef 43 9a fd 83 de a7 05 93 2d f6 ea d6 59 c7 fc 6f c9 b5 d7 52 97 84 f6 4c 43 be 58 ab e5 ce 49 c8 e5 77 f8 6c 63 a4 c4 0f 0b b8 b0 ef 34 7f 33 9e d3 81 56 1d dd b6 fd dc 32 c1 50 26 c4 ee 11 70 c7 b8 2f c6 eb ee 5d d4 6d f2 89 d1 db 95 c9 15 dc 97 ef 6b 2d 7c 24 06 86 69 53 30 59 e9 40 7b a8 6f 15 46 04 8f 2e 78 01 43 69 f8 Data Ascii: JP,wq u]yj.g}_xXyCN:a<A.WmA=a+K8Ov,pvC-YoRLCXIwlc43V2P&p/]mk-\|$iS0Y@{oF.xCi
2025-03-25 14:18:05 UTC	1369	IN	Data Raw: f3 8e 29 ad 31 1d 72 a7 c6 a1 b4 55 fa 9a 80 ab 72 a8 95 f2 e6 8e c4 33 61 c3 7b 06 ed 58 8e b0 a0 2c fa c8 f0 af 7d e0 ef 2b 2e 3d 96 4b 1d 1d 98 c7 ef 54 d3 a1 34 85 0d 9d 76 56 12 8e bb 71 5b 15 a0 84 cb 5f ce a7 c6 6c 40 6b 77 e6 88 33 85 b8 4d c7 74 44 bd df 7c 09 09 8d 52 28 8e 43 69 15 35 98 d5 86 07 40 89 3f 70 8c 20 56 01 a6 c2 74 4a c6 32 e0 6d ee b3 0d f3 d8 07 d3 c0 8c 38 52 33 4f 74 6a e2 4b 5f 7e b8 2c e6 9b cf 79 49 65 a4 62 8a 85 a1 1a 2b ea 86 a0 59 da 95 ce 1a c3 33 c2 a2 58 29 49 88 a7 a0 e1 c8 13 99 f1 3d 3c ce c7 83 e8 0b f3 1b 4a e0 59 f3 24 76 3d 4c a7 e5 50 88 1f 15 ef 21 d7 40 26 1d 1c f2 f5 fb cb 0d 86 e7 73 d2 88 1b 97 57 07 16 f3 d2 26 9c e4 2a 5c 98 67 25 4d 88 c8 ad f8 da f1 c9 a5 ee 3b 19 01 67 12 e7 5f f3 8d 31 7e c4 ee 97 Data Ascii: )1rUr3a{X,}+.=KT4vVq[_l@kw3MtD\|R(Ci5@?p VtJ2m8R3OtjK_~,yIeb+Y3X)I=<JY$v=LP!@&sW&*\g%M;g_1~
2025-03-25 14:18:05 UTC	1369	IN	Data Raw: a6 5d ab e2 f4 90 79 f2 a5 42 f9 e7 93 7e fc b9 63 5e 53 b1 32 df 89 f3 f7 7b 1e fd d7 97 ca af af 43 fe fa d2 50 e8 87 62 fc 56 a4 c7 d9 66 0b cf 25 62 9b 68 97 dd 69 2c 6c 64 63 2a d1 c1 23 ae bc b5 2b 85 33 5f cc 19 9f 3f d2 14 2f 0f 5c 7e de d2 02 94 3c fd 34 9f ec 0a 83 b5 67 dd a9 ca f9 71 da 0f 86 a4 c6 0f 77 ca 7b 5f b0 79 a1 8e ff 61 d5 df cb f8 6e 20 6b f6 a5 65 20 60 97 01 70 ec 88 01 36 ad b8 57 93 3f ca dc 49 e5 3b a5 a6 44 18 eb 1c f2 f7 ac ef 4c 07 d6 df e2 ce ab 31 ce 2f 89 e3 82 e6 98 7d 9d 98 d7 84 18 eb 8a 6f ca 75 42 84 2d a8 4c 23 2d 7e 9f 89 50 6f c7 8f 52 c9 a2 cf 1e 39 67 93 5f c5 94 6a bc b3 00 2a 59 21 b2 95 db fe f8 ca 7f 76 ba 16 78 3c ef 1c e5 ba 72 fc 93 c7 79 cc 2b 1c 57 9f 32 85 8d ab 46 2f b6 a7 4d f9 94 88 1e 12 47 98 67 Data Ascii: ]yB~c^S2{CPbVf%bhi,ldc#+3_?/\~<4gqw{_yan ke `p6W?I;DL1/}ouB-L#-~PoR9g_jY!vx<ry+W2F/MGg
2025-03-25 14:18:05 UTC	1369	IN	Data Raw: 01 ee d1 68 43 12 27 b9 93 33 1a 3e 02 3a 48 16 38 2f 73 6e 10 87 2c 9d ad 83 66 f8 87 c8 3a 99 ab 36 b0 68 9c 96 4b 51 62 b7 a5 87 6d 70 a8 38 f0 fe e4 45 e7 99 f1 22 5d 56 bc 7c 97 66 09 28 b6 16 a4 ab 65 7b 7e d8 1c 58 4b aa 39 65 89 ef cb a7 10 bf 5e 70 f2 c9 36 bc d8 13 f4 fc 1b a9 b3 c8 66 ce 1f 34 1e c7 07 8d e1 46 fe e5 88 20 be 73 d8 03 e7 b9 ba 40 67 bd bd 95 35 69 87 27 e5 01 f2 b2 5e 73 53 76 7d c7 0b 2a b7 f9 e3 f7 b1 9c 53 db 3a e0 e8 39 d7 9d 0e 31 ab 76 79 dc 9e eb 2a 8d 32 87 ff a8 c5 f7 74 e9 c8 4e 30 e3 55 bc 37 fe 2d 35 41 7f d6 62 d5 69 2b ac 77 30 43 68 6c 84 4a 63 40 51 b1 2d d7 d7 5e 0c b0 95 81 8a 34 c1 b5 07 c5 f3 ee 9d 5c f8 ae 3b d0 b7 02 98 d3 27 58 d7 3c 9f 26 30 ea 58 cb 7d 57 66 85 df b3 ea 86 df 5b f6 a5 f2 71 79 b9 4e ee Data Ascii: hC'3>:H8/sn,f:6hKQbmp8E"]V\|f(e{~XK9e^p6f4F s@g5i'^sSv}S:91vy2tN0U7-5Abi+w0ChlJc@Q-^4\;'X<&0X}Wf[qyN
2025-03-25 14:18:05 UTC	1369	IN	Data Raw: 77 65 cd 58 55 11 78 53 a5 68 63 06 d7 1d 5b c6 bf 42 b1 3f 80 4b cd db 09 31 b7 e6 ce 27 ed ce 8d 59 fd 58 65 d2 8a 21 72 4a c9 db 64 fc aa 3d 10 2d 14 08 18 16 03 47 e3 08 c5 f1 48 a3 02 c1 39 cf b8 a5 e5 71 fc 6a b7 65 cd ed ee 63 37 c9 e9 c1 6f 45 ea b6 1a 6f 3b ce ac cf e1 ae 2b dc e1 90 e1 bf 8f 29 04 c6 ee 79 10 c6 47 06 a3 37 df 5b 55 1b c3 eb 27 69 75 b8 c2 19 30 e3 9d e9 39 8d 1f ac e4 8f f7 33 ee 17 29 02 3e df 63 f7 08 8d 13 ea 63 03 be 1c 98 ce ab ae 7c d0 82 57 b0 22 6b 84 a6 9f 39 af 56 e3 31 0a 93 ce 9e 6a 49 b6 7b 97 92 87 a5 92 25 2b d3 6c 7c 20 cb c9 b5 6f 97 72 db 3e 2c 4c 48 64 91 b3 b6 79 fa 99 42 d2 5f ff 29 45 9e 49 df 51 e6 ef af f3 6d 0c bf 7c ce 1e e0 41 1e 77 e3 fc e5 38 fc 85 58 31 2a 71 63 a9 23 c9 e2 48 03 1b 64 6b ea bb 62 Data Ascii: weXUxShc[B?K1'YXe!rJd=-GH9qjec7oEo;+)yG7[U'iu093)>cc\|W"k9V1jI{%+l\| or>,LHdyB_)EIQm\|Aw8X1*qc#Hdkb
2025-03-25 14:18:05 UTC	1369	IN	Data Raw: d0 83 ac fb 78 1f 91 ef 0c 69 16 fb 3d 5d 46 c3 b0 99 38 38 53 de 1d 01 87 a3 c9 be 9d 49 ac 8f 3c 10 f0 99 de 71 ca 23 fa 5a 4a 3f f3 a3 f1 7e a7 d3 dc f1 fc 74 4c 88 6c 75 04 aa a1 c3 4b 86 4b b2 15 a2 ff 19 f7 2a ff 42 b6 0f 07 d6 72 e3 20 82 cd 03 7e e8 0f 57 56 e1 f4 78 c6 4b c8 cb c7 03 3c fc 9f e1 39 94 5f 95 78 57 7f 4f aa 83 7c a7 3f 7f 7a c7 32 78 cd cf 45 ef 7a 71 2b a3 d6 72 17 1b 63 a9 4b af b5 97 fe 5d b5 f1 f4 61 db 61 67 af a4 ed 68 75 ac a9 6c d7 8d b3 e7 02 42 2e 7d 16 c0 b6 e2 c2 73 60 fe 62 a7 e1 c8 7e 82 7d 46 41 50 03 74 52 ec b8 7a 68 1c 23 54 8a 5d b5 cc 51 d6 4b 05 ba 06 2d 48 66 b9 1b 39 0b bd a2 78 0c cd 19 92 37 ba a3 4d 2d ce d7 f2 5b e7 88 bb 9d 57 16 3a 48 98 58 f9 87 85 95 33 e2 c5 62 d1 62 3f 37 b0 e0 02 60 74 79 5b 9f 0a Data Ascii: xi=]F88SI<q#ZJ?~tLluKK*Br ~WVxK<9_xWO\|?z2xEzq+rcK]aaghulB.}s`b~}FAPtRzh#T]QK-Hf9x7M-[W:HX3bb?7`ty[
2025-03-25 14:18:05 UTC	1369	IN	Data Raw: e7 cf 5b 1a b9 0e 9e 3b 37 fc 6a 97 6e 75 1a a9 79 bd d2 7a c2 4a 8c 6b dd 75 86 cf 1d 0e da 8e b8 7a b8 02 20 b8 ab 37 eb d4 e5 f7 ae dc 7c f6 1d 02 3e 29 1c 3f 49 c1 40 18 d1 6a 1f 86 7b 11 d4 97 d7 9c c7 6c a5 23 14 e4 dc 91 d5 9a 92 d1 9b ec bb 7f d6 09 b3 1a 73 77 e0 a2 6d 16 9e dc 06 7f 96 70 75 a3 a6 bf 93 9b b6 f6 ef d9 a0 5b 1d 54 50 6e cb e9 03 51 71 15 8a 5e d7 da a6 c8 9e 82 6c 19 aa 75 f7 43 1f 19 c0 ce bb 57 50 6e a4 ae 84 c9 a5 1c 0c d1 15 96 8c 6b 23 30 6c 79 b5 c2 ae 3c 4e b4 5d 41 db 51 ba 1a e3 2b e7 b8 d2 ce ba 5a 57 86 2f 68 e9 13 8f 09 05 22 2c 9c c4 98 5e 9d cb 57 fa 91 b5 63 33 a5 b2 ab 15 37 e0 48 45 5c e6 f1 ad 38 ac 32 15 85 33 77 14 85 f3 08 c7 e7 68 67 53 c1 11 0e 2d f5 55 21 1d 75 85 f2 e9 4e 07 5f 2d c3 6d 56 a3 ae af e9 ac Data Ascii: [;7jnuyzJkuz 7\|>)?I@j{l#swmpu[TPnQq^luCWPnk#0ly<N]AQ+ZW/h",^Wc37HE\823whgS-U!uN_-mV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	148.135.1.141	443	5052	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-25 14:18:06 UTC	408	OUT	GET /favicon.ico HTTP/1.1 Host: lawful-lamontagne-7e83y.zipwp.top Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-25 14:18:06 UTC	279	IN	HTTP/1.1 200 OK Server: nginx-rc Date: Tue, 25 Mar 2025 14:18:06 GMT Content-Type: text/html Content-Length: 5606 Last-Modified: Thu, 28 Nov 2024 12:32:31 GMT Connection: close Vary: Accept-Encoding ETag: "674862df-15e6" Content-Type: text/html Accept-Ranges: bytes
2025-03-25 14:18:06 UTC	5606	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Verification</title> <style type="text/css"> body { margin: 0; }

Statistics

CPU Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Memory Usage

• chrome.exe
• chrome.exe
• chrome.exe

Click to jump to process

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 3772, Parent PID: 3492

Function Logs

General

Target ID:	1
Start time:	10:17:48
Start date:	25/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Registry Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

COM Activities

WMI Operations

Show Windows behavior

Process Activities

Process Created

Process Terminated

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5052, Parent PID: 3772

Function Logs

General

Target ID:	2
Start time:	10:17:51
Start date:	25/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2064,i,3254435716139963034,11654077455934367133,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2096 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Memory Activities

Memory Usage Statistics

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7076, Parent PID: 3492

Function Logs

General

Target ID:	4
Start time:	10:17:57
Start date:	25/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

File Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Process Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 49

Chrome Cache Entry: 50

Chrome Cache Entry: 51

Chrome Cache Entry: 52

Chrome Cache Entry: 53

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 3772, Parent PID: 3492

General

File Activities

File Opened

File Created

Windows Analysis Report
https://lawful-lamontagne-7e83y.zipwp.top/zipwp-login-67e2afa011731.php